Verifying collector connectivity - Verify collector connectivity and troubleshoot collector errors. - Administrator Guide - Cortex XDR - Cortex

Verifying collector connectivity - Verify collector connectivity and troubleshoot collector errors. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

License

Prevent

Pro

Creation date

2024-03-06

Last date published

2025-06-10

Troubleshooting collector errors

Note

For more information on troubleshooting data collector applet errors, see Troubleshoot Broker VM applet errors.

Each status change of an instance is logged in the collection_auditing dataset. Querying this dataset can help you see all the connectivity changes of an instance over time, the escalation or recovery of the connectivity status, and the error, warning, and informational messages related to status changes.

Example 58.

This example searches for status changes on Strata IOT integrations:

dataset = collection_auditing 
|filter collector_type = "STRATA_IOT"

You can create correlation rules that are based on the fields in the collection_auditing dataset.

Example 59. Example: Trigger collection alerts for error statuses on the STRATA_IOT collector

In this example, a correlation rule triggers an alert if an integration of the Strata IOT collector changes to error status.

Example XQL:

dataset = collection_auditing 
|filter classification = "Error" and collector_type = "STRATA_IOT"

Additional fields to specify in the correlation rule:

Field	Value
Time Schedule	Hourly
Query time frame	1 Hour
Alert Suppression	Select Enable alert suppression.
Action	Select Generate alert.
Severity	Medium
Category	Collection