Page Comparison

Purpose

This Activeboard provides measurements around the data source of your domain. It includes tables that have a significant decrease in ingestion compared to the historical averages, total volume seen over the last month, hourly volume breakdown, as well as new and missing hosts, users, and firewalls.

Pre-requisites

To use the Data Source Monitor Activeboard you must have the following sources available on your domain:

• siem.logtrust.collector.counter

• box.all.win ^{learn more}

• box.unix ^{learn more}

• firewall.all.traffic ^{learn more}

Open Security Operations Executive Overview

Once you have installed the Activeboard, you can access itin the following ways:

Exploring the Activeboard

When opening the Data Source Monitor Activeboard the following info is displayed. This Activeboard is divided into different areas:

• Main area: source data over time.

• Windows Host Information

• Linux Host Information

• User Information

• Firewall Hosts Information

Note
Load data takes too long Sometimes some widgets take time to upload the data, it is possible to speed up the process by creating aggregation tasks. Refer to Aggregation tasks article to learn how to do it.

Expand
title Click here to see the details of each section
Main area Anchor Main-area Main-area Widget Details Sources with no data today Sources with less 50% of normal volume Sources with less 50 % - 75 % of normal volume Total sources seen last 8 days Total volume last 30 days Data sources monitor Hourly event count of selected source Hourly ingrst volume (all sources) Windows Hosts Information Anchor Windows-Hosts-Information Windows-Hosts-Information Widget Details Hosts not reporting New hosts Linux Host Information Anchor Linux-Host-Information Linux-Host-Information Widget Details Hosts not reporting New hosts User information Anchor User-information User-information Widget Details Users not reporting New users Firewall Hosts Information Anchor Firewall-Hosts-Information Firewall-Hosts-Information Widget Details Firewalls not reporting New firewalls