Verifying Collector Connectivity - Administrator Guide - Cortex XSIAM - Cortex

Verifying Collector Connectivity - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product

Cortex XSIAM

Creation date

2024-07-16

Last date published

2024-10-13

Troubleshooting collector errors

Each status change of an instance is logged in the collection_auditing dataset. Querying this dataset can help you see all the connectivity changes of an instance over time, the escalation or recovery of the connectivity status, and the error, warning, and informational messages related to status changes.

Example 10.

This example searches for status changes on Strata IOT integrations:

dataset = collection_auditing 
|filter collector_type = "STRATA_IOT"

Cortex XSIAM provides OOTB Collection alerts that are triggered when a data collector instance is in error status, which means it is disconnected or not sending data. In addition, you can set up your own correlation rules that trigger collection alerts for your specific needs. For example, you might want to be alerted if a high profile collector is in warning status so that you can fix the problem and prevent the collector from disconnecting.

Example 11. Example: Trigger collection alerts for warning statuses on the STRATA_IOT collector

In this example, a correlation rule triggers a Collection health alert if an integration of the Strata IOT collector changes to warning status. Any triggered alerts will appear on the Health Alerts page.

Example XQL:

dataset = collection_auditing 
|filter classification = "Warning" and collector_type = "STRATA_IOT"

Additional fields to specify in the correlation rule:

Field	Value
Time Schedule	Hourly
Query time frame	1 Hour
Alert Suppression	Select Enable alert suppression.
Action	Select Generate alert.
Alert Domain	Health
Severity	Medium
Category	Collection Note If an alert is triggered, the investigation options in the right-click menu of the Health Alerts pages are context specific. Make sure that you specify the relevant alert category.

Troubleshooting collector errors

Note