Forum Discussion

miguelfac's avatar
miguelfac
Copper Contributor
Jun 21, 2023

Data Connector - Analytics Rule

Hi everyone,   I want to have a analytic rule / Automation Rule that everytime that a certain connector (e.g Some Firewall Connector) is down, to receive a Alert in Sentinel. I've been searching f...
  • Clive_Watson's avatar
    Jun 21, 2023

    miguelfac 

     

    There are lots of scenarios for this. The most common solution is to monitor for a time delay - so if there is no data in say 15mins then it's probably down. However it could just as easily not have sent any data in that period, so you may have to also check back to the same period the day or week before to see if its uncommon.  You may need different thresholds for each connector/Table - so a watchlist can help.
    Anomaly detection can help here as well - look at series_decompose_anomalies(), however in a Rule you are limited to 14days lookback - which isn't often enough to detect seasonal patterns. 
     

    If the data is from Syslog /CommonSecurtitylog, you may actually want to monitor the Log collector server(s), using the Heartbeat table, so if for example one server fails out of 4 you still have 75% online capacity - if you just monitored the connector/Table then all 4 have to fail (or not send data).
    There are some basic examples in the Queries pane for Heartbeat. 

     



Share

Resources