Data Source Monitor Activeboard

Purpose

This Activeboard provides measurements around the data source of your domain. It includes tables that have a significant decrease in ingestion compared to the historical averages, total volume seen over the last month, hourly volume breakdown, as well as new and missing hosts, users, and firewalls.

Pre-requisites

To use the Data Source Monitor Activeboard you must have the following sources available on your domain:

siem.logtrust.collector.counter
box.all.win ^{learn more}
box.unix ^{learn more}
firewall.all.traffic ^{learn more}

Open Security Operations Executive Overview

Once you have installed the Activeboard, you can access it in the following ways:

Go to Exchange in the navigation pane and look for the Activeboard you want to open. Click Open.

Go to Activeboards in the navigation pane and use the filter to open the Activeboard you downloaded.

Know more about Activeboards

Refer to Manage and filter Activeboards article to know how to work with Activeboards.

Exploring the Activeboard

When opening the Data Source Monitor Activeboard the following info is displayed. This Activeboard is divided into different areas:

Main area: source data over time.
Windows Host Information
Linux Host Information
User Information
Firewall Hosts Information

Click here to see the details of each section

Main area

Widget	Details
	Sources with no data today
	Sources with less 50% of normal volume
	Sources with less 50 % - 75 % of normal volume
	Total sources seen last 8 days
	Total volume last 30 days
	Data sources monitor
	Hourly event count of selected source
	Hourly ingrst volume (all sources)

Windows Hosts Information

Widget	Details
	Hosts not reporting
	New hosts

Linux Host Information

Widget	Details
	Hosts not reporting
	New hosts

User information

Widget	Details
	Users not reporting
	New users

Firewall Hosts Information

Widget	Details
	Firewalls not reporting
	New firewalls