Verify collector connectivity - Verify collector connectivity and troubleshoot collector errors. - Administrator Guide - Cortex XSIAM - Cortex

Verify collector connectivity - Verify collector connectivity and troubleshoot collector errors. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Troubleshooting collector errors

Note

For more information on troubleshooting data collector applet errors, see Troubleshoot Broker VM applet connectivity.

Each status change of an instance is logged in the collection_auditing dataset. Querying this dataset can help you see all the connectivity changes of an instance over time, the escalation or recovery of the connectivity status, and the error, warning, and informational messages related to status changes.

Example 91.

This example searches for status changes on Strata IOT integrations:

dataset = collection_auditing 
|filter collector_type = "STRATA_IOT"

Cortex XSIAM provides OOTB Collection issues that are triggered when a data collector instance is in error status, which means it is disconnected or not sending data. In addition, you can set up your own correlation rules that trigger collection issues for your specific needs. For example, you might want to be notified if a high-profile collector is in warning status so that you can fix the problem and prevent the collector from disconnecting.

Example 92. Example: Trigger collection issues for warning statuses on the STRATA_IOT collector

In this example, a correlation rule triggers a Collection issue if an integration of the Strata IOT collector changes to warning status. Any issues will appear on the Health Issues page.

Example XQL:

dataset = collection_auditing 
|filter classification = "Warning" and collector_type = "STRATA_IOT"

Additional fields to specify in the correlation rule:

Field	Value
Time Schedule	Hourly
Query time frame	1 Hour
Issue Suppression	Select Enable issue suppression.
Action	Select Generate issue.
Issue Domain	Health
Severity	Medium
Category	Collection Note If an issue is triggered, the investigation options in the right-click menu of the Health Issues pages are context-specific. Make sure that you specify the relevant issue category.