{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"2"},"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"812af86120b7d64463b747ac09afa7ed"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"72c9b4a1-f493-4b84-b268-16358df35c8b"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Cortex XDR delivers enterprise-wide protection by analyzing data from any source to stop sophisticated attacks.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Eliminate blind spots with complete visibility","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Simplify security operations to cut mean time to respond (MTTR)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Harness the scale of the cloud for AI and analytics","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Lower costs by consolidating tools and improving SOC efficiency.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Cortex XDR collector migration guide (from 1.x.x to 2.x.x)","type":"text"}]},{"type":"paragraph","content":[{"text":"If you need to migrate an old collector version to a more recent one, please check the migration process ","type":"text"},{"text":"in this article","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/839712805"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Devo collector features","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"f48ad8b8-7930-46b5-b027-a7ba67d41d64"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Feature","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Allow parallel downloading (","type":"text"},{"text":"multipod","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"not allowed","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Running environments","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"collector server","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"on-premise","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Populated Devo events","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"table","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Flattening preprocessing","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"no","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Requires IP Whitelisting","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"no","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data sources","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"9e5be5d4-b41d-47dc-b20a-be75155ec716"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Data source","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"API endpoint","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[111.0]},"content":[{"type":"paragraph","content":[{"text":"Collector service name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Devo table","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[82.0]},"content":[{"type":"paragraph","content":[{"text":"Available from release","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Get a list of alerts with multiple events.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"https:///public_api/v2/alerts/get_alerts_multi_events","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[111.0]},"content":[{"type":"paragraph","content":[{"text":"alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"edr.cortex_xdr.alerts_multi","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You can override this in ","type":"text"},{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]},{"text":" in the incident module definition.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[82.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"v2.0.0","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Incidents","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Get Incidents","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"},{"type":"hardBreak"},{"text":"Get a list of incidents filtered by a list of incident IDs, modification time, or creation time.","type":"text"}]},{"type":"paragraph","content":[{"text":"Get Incident Alerts","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"},{"type":"hardBreak"},{"text":"Get extra data fields of a specific incident including alerts and key artifacts.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"List Incidents:","type":"text"},{"type":"hardBreak"},{"text":"https:///public_api/v1/incidents/get_incidents","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"List Incident Alerts:","type":"text"}]},{"type":"paragraph","content":[{"text":"https:///public_api/v1/incidents/get_incident_extra_data","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[111.0]},"content":[{"type":"paragraph","content":[{"text":"incidents","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"List Incidents:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"edr.cortex_xdr.incidents","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You can override this in ","type":"text"},{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]},{"text":" in the incident module definition.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"List Incident Alerts:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"edr.cortex_xdr.incident_alert","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You can override this in ","type":"text"},{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]},{"text":" in the incident module definition.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[82.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"v2.0.0","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"All Alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Get a list of alerts.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"https:///public_api/v1/alerts/get_alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[111.0]},"content":[{"type":"paragraph","content":[{"text":"all_alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"edr.cortex_xdr.all_alert","type":"text","marks":[{"type":"code"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You can override this in ","type":"text"},{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]},{"text":" in the incident module definition.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[82.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"v2.0.0","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Audit Managements","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Get audit management logs.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"https:///public_api/v1/audits/management_logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[111.0]},"content":[{"type":"paragraph","content":[{"text":"audit_management","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"edr.cortex_xdr.audit_management","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You can override this in ","type":"text"},{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]},{"text":" in the incident module definition.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[82.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"v2.0.0","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Vendor configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Generate API key","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in to your ","type":"text"},{"text":"Cortex XDR","type":"text","marks":[{"type":"strong"}]},{"text":" console with an administrative account.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the ","type":"text"},{"text":"Settings","type":"text","marks":[{"type":"strong"}]},{"text":" menu (gear icon).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"API Keys","type":"text","marks":[{"type":"strong"}]},{"text":" under the ","type":"text"},{"text":"Integrations","type":"text","marks":[{"type":"strong"}]},{"text":" section.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Add Key","type":"text","marks":[{"type":"strong"}]},{"text":" to generate a new API key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the roles or permissions you want to assign to this key (these determine the actions the key can perform).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create","type":"text","marks":[{"type":"strong"}]},{"text":" for generating the ","type":"text"},{"text":"API Key","type":"text","marks":[{"type":"strong"}]},{"text":" along with an ","type":"text"},{"text":"API Key ID","type":"text","marks":[{"type":"strong"}]},{"text":". Save these securely, as you may not be able to retrieve them later.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"API FQDN","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"API FQDN","type":"text","marks":[{"type":"strong"}]},{"text":" (Fully Qualified Domain Name) can be found in the documentation or directly in the URL when you are logged into your Cortex XDR console.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"It will usually be in the format: ","type":"text"},{"text":"https://.xdr.paloaltonetworks.com","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Minimum configuration required for basic pulling","type":"text"}]},{"type":"paragraph","content":[{"text":"Although this collector supports advanced configuration, the fields required to download data with basic configuration are defined below.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.","type":"text"}]}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"3b57afff-3175-469a-8862-885a717532c7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Setting","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[607.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key is your unique identifier for Cortex XDR.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"api_key_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key ID is your unique token used to authenticate the API key for Cortex XDR.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"api_fqdn","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.0]},"content":[{"type":"paragraph","content":[{"text":"API FQDN is a unique host and domain name associated with each tenant for Cortex XDR.","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"See the ","type":"text"},{"text":"Accepted authentication methods","type":"text","marks":[{"type":"strong"}]},{"text":" section to verify what settings are required based on the desired authentication method.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Accepted authentication methods","type":"text"}]},{"type":"paragraph","content":[{"text":"Depending on how did you obtain your credentials, you will have to either fill or delete the following properties on the JSON ","type":"text"},{"text":"credentials","type":"text","marks":[{"type":"code"}]},{"text":" configuration block.","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"15ebd28a-c602-416d-99ae-8c977242c814"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[320.0]},"content":[{"type":"paragraph","content":[{"text":"Authentication method","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"API key","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"API key ID","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"API FQDN","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[320.0]},"content":[{"type":"paragraph","content":[{"text":"API KEY / API KEY ID / API FQDN","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"type":"status","attrs":{"color":"green","style":"bold","text":"required","localId":"a555c262-bf80-4a4b-8a54-26232b80f65c"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[138.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"type":"status","attrs":{"color":"green","style":"bold","text":"required","localId":"ad9e0fa8-cb7e-4016-a092-8835d68e3786"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[149.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"type":"status","attrs":{"color":"green","style":"bold","text":"required","localId":"789966da-72a3-4a93-ae00-baf470e0ddf2"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (","type":"text"},{"text":"Cloud collector","type":"text","marks":[{"type":"underline"}]},{"text":"), or deploy and host the collector in your own machine using a Docker image (","type":"text"},{"text":"On-premise collector","type":"text","marks":[{"type":"underline"}]},{"text":").","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"6a805bc0-abf6-4d98-987c-6a9164c77642"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"51a38310-b288-4fb7-a20e-43dcd020e55a"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"2825992cb366f7c43cdf1373692654dc"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"cac5082e-5b49-4526-b298-c4d1254290bd"}},{"type":"paragraph","content":[{"text":"The Collector Server is a managed platform that allows running sets of different collectors grouped by Devo domain destinations.","type":"text"}]},{"type":"paragraph","content":[{"text":"To run an instance of this data collector, the next steps must be followed:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Server","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"GUI","type":"text","marks":[{"type":"strong"}]},{"text":", access the ","type":"text"},{"text":"domain","type":"text","marks":[{"type":"strong"}]},{"text":" where you want to create this instance, click ","type":"text"},{"text":"Add Collector,","type":"text","marks":[{"type":"strong"}]},{"text":" search for “","type":"text"},{"text":"Cortex XDR - Integrations Factory","type":"text","marks":[{"type":"strong"}]},{"text":"”, then click on the result.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Version","type":"text","marks":[{"type":"strong"}]},{"text":" field, select the latest value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Name","type":"text","marks":[{"type":"strong"}]},{"text":" field, set the value you prefer (this name must be unique inside the same Collector Server domain).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" section, establish the ","type":"text"},{"text":"Collector Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" as follows below:Collector services detail","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please, replace the placeholders ","type":"text"},{"text":",","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" in the next section with the values obtained in previous sections of this document, except the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" that can have the value you choose. Do not substitute the occurrences of ","type":"text"},{"text":"{api_fqdn}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"global_overrides\": {\n \"debug\": \n },\n \"inputs\": {\n \"cortex_xdr\": {\n \"id\": \"\",\n \"enabled\": true,\n \"credentials\": {\n \"api_key\": \"\",\n \"api_key_id\": \"\"\n },\n \"services\": {\n \"incidents\": {\n \"api_fqdn\": \"\",\n \"request_period_in_seconds\" : \",\n \"start_time\": \"\",\n \"include_incident_alerts\": \"\",\n \"override_devo_tag\": \"\"\n \"override_incident_alert_tag\": \"\"\n },\n \"alerts\": {\n \"api_fqdn\": \"\",\n \"request_period_in_seconds\" : \",\n \"start_time\": \"\",\n \"override_devo_tag\": \"\"\n },\n \"all_alerts\": {\n \"api_fqdn\": \"\",\n \"request_period_in_seconds\" : \",\n \"start_time\": \"\",\n \"override_devo_tag\": \"\"\n },\n \"audit_managements\": {\n \"api_fqdn\": \"\",\n \"request_period_in_seconds\" : \",\n \"start_time\": \"\",\n \"override_devo_tag\": \"\"\n }\n }\n }\n }\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the ","type":"text"},{"text":"services","type":"text","marks":[{"type":"code"}]},{"text":" object.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please replace the placeholders with real world values following the description table below","type":"text"}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"6f1b170a-9ee8-4b27-a06a-abddc0bf32e8"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Value range / Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Lenght 5","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a unique id to this input service.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" / ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to enable or disable the given input logic when running the collector. If the value is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", the input will be run. If the value is ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":", it will be ignored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key is your unique identifier used as the ","type":"text"},{"text":"Authorization:{key}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key ID is your unique token used to authenticate the API Key. It is used in headers as ","type":"text"},{"text":"x-xdr-auth-id:{key_id}","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"The FQDN is a unique host and domain name associated with each tenant. When you generate the API Key and Key ID, you are assigned an individual FQDN. ex: ","type":"text"},{"text":"https://{api-fqdn}/public_api/v1/incidents/get_incidents","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"A devo tag","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"This parameter allows to define a custom devo tag.","type":"text"},{"type":"hardBreak"},{"text":"ex: ","type":"text"},{"text":"my.app.devo.service","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"A Incident Alert tag","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"This Tag is only applicable for ","type":"text"},{"text":"Incidents","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"service","type":"text","marks":[{"type":"strong"}]},{"text":" to override the tag of ","type":"text"},{"text":"Incident alerts(","type":"text","marks":[{"type":"strong"}]},{"text":" Extra incident endpoint). Ex: ","type":"text"},{"text":"my.app.devo.Incident_alert","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"boolean","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"A boolean to Include Incidents alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"By default the value of this boolean is ‘","type":"text"},{"text":"true’","type":"text","marks":[{"type":"strong"}]},{"text":". If given ‘","type":"text"},{"text":"false","type":"text","marks":[{"type":"strong"}]},{"text":"’ we will not be able to get incident alerts data ","type":"text"}]},{"type":"paragraph","content":[{"text":"(Extra incidents data ","type":"text"},{"text":"for endpoint","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"v1/incidents/get_incident_extra_data","type":"text","marks":[{"type":"code"}]},{"text":"). Ex : ","type":"text"},{"text":"true, false","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Note: For This endpoint, the data gets ingested in the table ","type":"text"},{"text":"edr.cortex_xdr.incident_alert","type":"text","marks":[{"type":"code"}]},{"text":" and this table may contains duplicates because we are using ","type":"text"},{"text":"incident_id","type":"text","marks":[{"type":"code"}]},{"text":" to get the data and these ","type":"text"},{"text":"incident_ids","type":"text","marks":[{"type":"code"}]},{"text":" can be duplicates. ","type":"text"},{"type":"hardBreak"},{"text":"We are using ","type":"text"},{"text":"modification_time","type":"text","marks":[{"type":"code"}]},{"text":" instead of ","type":"text"},{"text":"creation_time","type":"text","marks":[{"type":"code"}]},{"text":" to filter the ","type":"text"},{"text":"incident_ids","type":"text","marks":[{"type":"code"}]},{"text":" causing duplicates.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[88.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"start time in utc ","type":"text"},{"type":"hardBreak"},{"text":"format: %Y-%m-%dT%H:%M:%SZ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"This parameter allows to get the data from provided start time. If not provided it will take current-time as time. Ex:- 2024-01-01T01:50:00Z","type":"text"}]}]}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"0e08d10a084320745cfcad174c481cfb"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"3392ad6b-e017-4587-96ac-e5e9d4459cb2"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for being used when running the collector:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── /\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n ├── state/\n └── config/ \n └── config.yaml ","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text"},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text"},{"text":"/certs/","type":"text","marks":[{"type":"code"}]},{"text":". Learn more about security credentials in Devo ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":748,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":950,"alt":"image-20240528-122729.png","id":"e4560938-068a-4f87-bccb-095e893eaa64","collection":"contentId-645726232","type":"file","height":448}}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the config.yaml file","type":"text"}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: false\n id: not_used\n name: cortex_xdr\n persistence:\n type: filesystem\n config:\n directory_name: state\n\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: collector-us.devo.io\n port: 443\n type: SSL\n chain: chain.crt\n cert: .crt\n key: .key\n console_1:\n type: console\n\ninputs:\n cortex_xdr:\n id: \n enabled: true\n credentials:\n api_key: \n api_key_id: \n services:\n incidents:\n api_fqdn: \n request_period_in_seconds : #optional\n start_time: #optional\n include_incident_alerts: #Optional\n override_devo_tag: #optional\n override_incident_alert_tag: #optional\n alerts:\n api_fqdn: \n start_time: # Example 2024-01-01T01:50:00Z\n request_period_in_seconds: #optional\n override_devo_tag: #optional\n all_alerts:\n api_fqdn: \n start_time: # Example 2024-01-01T01:50:00Z #optional\n request_period_in_seconds: #optional\n override_devo_tag: #optional\n audit_managements:\n api_fqdn: \n start_time: # Example 2024-01-01T01:50:00Z #optional\n request_period_in_seconds: #optional\n override_devo_tag: #optional","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the ","type":"text"},{"text":"services","type":"text","marks":[{"type":"code"}]},{"text":" object.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please replace the placeholders with real world values following the description table below","type":"text"}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"036b1052-2e85-49e9-b287-b8598c2f7a30"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Value range / Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"short_unique_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Lenght 5","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a unique id to this input service.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"input_status","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" / ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to enable or disable the given input logic when running the collector. If the value is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", the input will be run. If the value is ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":", it will be ignored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key is your unique identifier used as the ","type":"text"},{"text":"Authorization:{key}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"api_key_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"The API Key ID is your unique token used to authenticate the API Key. It is used in headers as ","type":"text"},{"text":"x-xdr-auth-id:{key_id}","type":"text","marks":[{"type":"code"}]},{"text":" while calling the API.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"api_fqdn","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"The {api_fqdn} FQDN is a unique host and domain name associated with each tenant. When you generate the API Key and Key ID, you are assigned an individual FQDN. ex: ","type":"text"},{"text":"https://{api-fqdn}/public_api/v1/incidents/get_incidents","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum Length 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"override_devo_tag","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"A devo tag","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"This parameter allows to define a custom devo tag.","type":"text"},{"type":"hardBreak"},{"text":"ex: ","type":"text"},{"text":"my.app.devo.service","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"override_incident_alert_tag","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"A Incident Alert tag","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"This Tag is only applicable for ","type":"text"},{"text":"Incidents","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"service","type":"text","marks":[{"type":"strong"}]},{"text":" to override the tag of ","type":"text"},{"text":"Incident alerts (","type":"text","marks":[{"type":"strong"}]},{"text":" Extra incident endpoint). Ex: ","type":"text"},{"text":"my.app.devo.Incident_alert","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"include_incident_alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"boolean","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"A boolean to Include Incidents alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"By default the value of this boolean is ‘","type":"text"},{"text":"true’","type":"text","marks":[{"type":"strong"}]},{"text":". If given ‘","type":"text"},{"text":"false","type":"text","marks":[{"type":"strong"}]},{"text":"’ we will not be able to get incident alerts data (Extra incidents data ","type":"text"},{"text":"for endpoint","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"v1/incidents/get_incident_extra_data","type":"text","marks":[{"type":"code"}]},{"text":"). Ex : ","type":"text"},{"text":"true, false","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Note: For This endpoint, the data gets ingested in the table ","type":"text"},{"text":"edr.cortex_xdr.incident_alert","type":"text","marks":[{"type":"code"}]},{"text":" and this table may contains duplicates because we are using ","type":"text"},{"text":"incident_id","type":"text","marks":[{"type":"code"}]},{"text":" to get the data and these ","type":"text"},{"text":"incident_ids","type":"text","marks":[{"type":"code"}]},{"text":" can be duplicates. ","type":"text"},{"type":"hardBreak"},{"text":"We are using ","type":"text"},{"text":"modification_time","type":"text","marks":[{"type":"code"}]},{"text":" instead of ","type":"text"},{"text":"creation_time","type":"text","marks":[{"type":"code"}]},{"text":" to filter the ","type":"text"},{"text":"incident_ids","type":"text","marks":[{"type":"code"}]},{"text":" causing duplicates.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"start_time","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[106.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[171.0]},"content":[{"type":"paragraph","content":[{"text":"start time in utc ","type":"text"},{"type":"hardBreak"},{"text":"format: %Y-%m-%dT%H:%M:%SZ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[180.0]},"content":[{"type":"paragraph","content":[{"text":"This parameter allows to get the data from provided start time. If not provided it will take current-time as time. Ex:- 2024-01-01T01:50:00Z","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"94785be3-54fc-4266-9d73-deee265f1451"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[335.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[391.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[335.0]},"content":[{"type":"paragraph","content":[{"text":"collector-cortex_xdr_if-docker-image-2.0.4","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1q5p57vPnWW8qTSj2GNzoGXeBvxxhGiA2/view?usp=drive_link"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[391.0]},"content":[{"type":"paragraph","content":[{"text":"6a1c62cfeb366873d2fcc67dbb2ccefc69841941e99b054f1ab8b27aca8752f5","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text"}]},{"type":"codeBlock","content":[{"text":"gunzip -c -.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with a proper value.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \n--name collector- \n--volume $PWD/certs:/devo-collector/certs \n--volume $PWD/config:/devo-collector/config \n--volume $PWD/state:/devo-collector/state \n--env CONFIG_FILE=config.yaml \n--rm \n--interactive \n--tty \n:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper values.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-:\n image: :${IMAGE_VERSION:-latest}\n container_name: collector-\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./credentials:/devo-collector/credentials\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text"}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper values.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Collector services detail","type":"text"}]},{"type":"paragraph","content":[{"text":"This section is intended to explain how to proceed with specific actions for services.","type":"text"}]},{"type":"expand","attrs":{"title":"Common sections for Services"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify data collection","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Service components","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the collector has been launched, it is important to check if the ingestion is performed in a proper way. To do so, go to the collector’s logs console.","type":"text"}]},{"type":"paragraph","content":[{"text":"This service has the following components:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"29ab841c-5dd9-41f0-a77a-c469687e342d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[166.0]},"content":[{"type":"paragraph","content":[{"text":"Component","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[564.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[166.0]},"content":[{"type":"paragraph","content":[{"text":"Setup","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[564.0]},"content":[{"type":"paragraph","content":[{"text":"The setup module is in charge of authenticating the service and managing the token expiration when needed.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[166.0]},"content":[{"type":"paragraph","content":[{"text":"Puller","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[564.0]},"content":[{"type":"paragraph","content":[{"text":"The setup module is in charge of pulling the data in a organized way and delivering the events via SDK.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Setup is common for every service, so its output is displayed in this section.","type":"text"}]},{"type":"paragraph","content":[{"text":"On the other hand, Pullers are specific to each Service, so their outputs are shown in their corresponding sections below.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Setup output","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful run has the following output messages for the setup module:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T15:07:25.139 INFO MainProcess::MainThread -> Started all objects from \"MainProcess\" process\n2024-09-06T15:07:25.144 INFO InputProcess::MainThread -> Process started (pid=19803, ppid=19784, multiprocessing.start_method=\"fork\")\n2024-09-06T15:07:25.220 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;standard_senders;devo_1.json.gz\n2024-09-06T15:07:25.223 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.224 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5bdbabbd30e1988d6e2b0b74b6ec3289\"\n2024-09-06T15:07:25.227 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;incidents;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.231 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.231 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/6a3859facec8d617720d39590e169164\"\n2024-09-06T15:07:25.232 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/c620dfb5bdc3fc1a386e4924e99aa3e7\"\n2024-09-06T15:07:25.232 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;standard_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/6a3859facec8d617720d39590e169164\"\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/c620dfb5bdc3fc1a386e4924e99aa3e7\"\n2024-09-06T15:07:25.235 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.235 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/b1ee30ea2c4b3be1eb50c8b2ca80d8d8\"\n2024-09-06T15:07:25.235 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.236 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.238 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputStandardConsumer;standard_senders;0.json.gz\n2024-09-06T15:07:25.241 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.241 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/de28663278a264d05d531fbc1db51a93\"\n2024-09-06T15:07:25.242 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.243 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;lookup_senders;devo_1.json.gz\n2024-09-06T15:07:25.246 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.246 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/a28c135f3fc69ece87d8fc2fdb029e8c\"\n2024-09-06T15:07:25.251 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;lookup_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.252 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.253 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.253 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/df8895fef2a509cbd87fcc9850dc0c81\"\n2024-09-06T15:07:25.255 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputLookupConsumer;lookup_senders;0.json.gz\n2024-09-06T15:07:25.256 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.257 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.257 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/865a79c1b99ad39b22becc235c9732cb\"\n2024-09-06T15:07:25.259 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.259 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;internal_senders;devo_1.json.gz\n2024-09-06T15:07:25.260 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.260 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.261 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.261 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.261 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.261 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/e784c94a6fe28de5937e50674407d82e\"\n2024-09-06T15:07:25.265 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) Finalizing the execution of init_variables()\n2024-09-06T15:07:25.265 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;internal_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.268 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.268 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/4ff7b345dc444ac050cf75f93e5dcb3b\"\n2024-09-06T15:07:25.269 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;alerts;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.271 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputInternalConsumer;internal_senders;0.json.gz\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/50e7b9f5b3320841b223e83e5b156b5f\"\n2024-09-06T15:07:25.272 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5a07c27e666ce7c4400ef58d5b89f174\"\n2024-09-06T15:07:25.273 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/10dd360c86621afd5a28a029a0dddcf6\"\n2024-09-06T15:07:25.273 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/50e7b9f5b3320841b223e83e5b156b5f\"\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5a07c27e666ce7c4400ef58d5b89f174\"\n2024-09-06T15:07:25.274 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(standard_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.275 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.275 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.275 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.276 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.276 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.276 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.277 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(lookup_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.279 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.279 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.279 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.279 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.280 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.280 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.280 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.282 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(internal_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.01\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.285 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.01\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.286 INFO OutputProcess::OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.287 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.289 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.289 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.294 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.298 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.299 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.300 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.301 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.302 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.302 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) Finalizing the execution of init_variables()\n2024-09-06T15:07:25.307 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;all_alerts;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.310 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.311 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/30e04fb750908b6e56aa65c0390708bf\"\n2024-09-06T15:07:25.311 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/9e181361d214f7eaac0dcc0853396aef\"\n2024-09-06T15:07:25.312 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.313 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/30e04fb750908b6e56aa65c0390708bf\"\n2024-09-06T15:07:25.313 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/9e181361d214f7eaac0dcc0853396aef\"\n2024-09-06T15:07:25.314 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.315 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.321 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.339 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.339 INFO OutputProcess::OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.340 INFO OutputProcess::OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.05\n2024-09-06T15:07:25.341 INFO OutputProcess::MainThread -> [GC] global: 42.0% -> 42.0%, process: RSS(41.21MiB -> 41.21MiB), VMS(929.01MiB -> 929.01MiB)\n2024-09-06T15:07:25.349 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.353 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.354 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.356 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.357 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.358 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.359 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) Finalizing the execution of init_variables()\n2024-09-06T15:07:25.367 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;audit_managements;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.373 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.373 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/ae374cefc744c8268f07d37056e660e2\"\n2024-09-06T15:07:25.373 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/93607031cbbdac722344eb2b8746cfdc\"\n2024-09-06T15:07:25.375 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.376 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/ae374cefc744c8268f07d37056e660e2\"\n2024-09-06T15:07:25.376 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/93607031cbbdac722344eb2b8746cfdc\"\n2024-09-06T15:07:25.378 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.379 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.386 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.399 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.405 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.408 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.409 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.410 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.411 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.413 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.415 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) Finalizing the execution of init_variables()\n2024-09-06T15:07:25.419 INFO InputProcess::MainThread -> InputThread(cortex_xdr,1243598) - Starting thread (execution_period=60s)\n2024-09-06T15:07:25.420 INFO InputProcess::MainThread -> ServiceThread(cortex_xdr,1243598,incidents,predefined) - Starting thread (execution_period=60s)\n2024-09-06T15:07:25.421 INFO InputProcess::MainThread -> CortexXdrPullerSetup(cortex_xdr,cortex_xdr#1243598,incidents#predefined) -> Starting thread\n2024-09-06T15:07:25.422 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) - Starting thread\n2024-09-06T15:07:25.430 WARNING InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Waiting until setup will be executed\n2024-09-06T15:07:25.431 INFO InputProcess::MainThread -> ServiceThread(cortex_xdr,1243598,alerts,predefined) - Starting thread (execution_period=60s)\n2024-09-06T15:07:25.432 INFO InputProcess::MainThread -> CortexXdrPullerSetup(cortex_xdr,cortex_xdr#1243598,alerts#predefined) -> Starting thread\n2024-09-06T15:07:25.433 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) - Starting thread\n2024-09-06T15:07:25.435 WARNING InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> Waiting until setup will be executed\n2024-09-06T15:07:25.438 INFO InputProcess::MainThread -> ServiceThread(cortex_xdr,1243598,all_alerts,predefined) - Starting thread (execution_period=60s)\n2024-09-06T15:07:25.440 INFO InputProcess::MainThread -> CortexXdrPullerSetup(cortex_xdr,cortex_xdr#1243598,all_alerts#predefined) -> Starting thread\n2024-09-06T15:07:25.440 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) - Starting thread\n2024-09-06T15:07:25.444 WARNING InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Waiting until setup will be executed\n2024-09-06T15:07:25.445 INFO InputProcess::MainThread -> ServiceThread(cortex_xdr,1243598,audit_managements,predefined) - Starting thread (execution_period=60s)\n2024-09-06T15:07:25.446 INFO InputProcess::MainThread -> CortexXdrPullerSetup(cortex_xdr,cortex_xdr#1243598,audit_managements#predefined) -> Starting thread\n2024-09-06T15:07:25.448 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) - Starting thread\n2024-09-06T15:07:25.451 WARNING InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Waiting until setup will be executed\n2024-09-06T15:07:25.494 INFO InputProcess::MainThread -> [GC] global: 42.1% -> 42.1%, process: RSS(41.61MiB -> 41.73MiB), VMS(1.05GiB -> 1.05GiB)\n2024-09-06T15:07:25.780 INFO OutputProcess::DevoSender(internal_senders,devo_sender_0) -> Created a sender: {\"name\": \"DevoSender(internal_senders,devo_sender_0)\", \"url\": \"collector-eu.devo.io:443\", \"chain_path\": \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/certs/chain.crt\", \"cert_path\": \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/certs/int-if-integrations-india.crt\", \"key_path\": \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/certs/int-if-integrations-india.key\", \"transport_layer_type\": \"SSL\", \"last_usage_timestamp\": null, \"socket_status\": null}, hostname: \"2023-apac-0046\", session_id: \"124794842200288\"\n2024-09-06T15:07:25.781 INFO OutputProcess::DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:28.870 INFO InputProcess::CortexXdrPullerSetup(cortex_xdr,cortex_xdr#1243598,incidents#predefined) -> Setup for module has been successfully executed","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"Some services in this collector use persistent storage to download events in an orderly fashion and avoid duplicates. In case you want to re-ingest historical data or recreate the persistence, you can restart the persistence of this collector by following these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the configuration file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the value of the ","type":"text"},{"text":"start_date","type":"text","marks":[{"type":"code"}]},{"text":" parameter to a different one.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the changes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the collector.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The collector will detect this change and will restart the persistence using the parameters of the configuration file or the default configuration in case it has not been provided.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Note that this action clears the persistence and cannot be recovered in any way. Resetting persistence could result in duplicate or lost events.","type":"text"}]}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"}]},{"type":"expand","attrs":{"title":"Alerts Service"},"content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This Service no longer uses ","type":"text"},{"text":"edr.cortex_xdr.alerts_multi_event","type":"text","marks":[{"type":"code"}]},{"text":" table to ingest the events Data. Now, All the Data will be ingested in ","type":"text"},{"text":"edr.cortex_xdr.alerts_multi","type":"text","marks":[{"type":"code"}]},{"text":" .","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"We are using ","type":"text"},{"text":"v2/alerts/get_alerts_multi_events","type":"text","marks":[{"type":"code"}]},{"text":" endpoint now but earlier we were using ","type":"text"},{"text":"v1/alerts/get_alerts_multi_events","type":"text","marks":[{"type":"code"}]},{"text":"endpoint to fetch the data.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify data collection","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful initial run has the following output messages for the puller module:","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Note that the ","type":"text"},{"text":"PrePull","type":"text","marks":[{"type":"code"}]},{"text":" action is executed only one time before the first run of the ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"024-09-06T15:30:53.884 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> Pull Started\n2024-09-06T15:30:53.886 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> start time_stamp to fetch the data is: 1725616793881 \n2024-09-06T15:30:53.887 INFO OutputProcess::DevoSender(internal_senders,devo_sender_0) -> Consumed messages: 11 messages (60.001491 seconds) => 0 msg/sec\n2024-09-06T15:30:59.379 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725616853882):Number of requests made: 1; Number of events received: 0; Number of duplicated events filtered out: 0; Number of events generated and sent: 0; Average of events per second: 0.000.\n2024-09-06T15:30:59.380 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> Sent 0 events to Devo.\n2024-09-06T15:30:59.382 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725616853882):Number of requests made: 1; Number of events received: 0; Number of duplicated events filtered out: 0; Number of events generated and sent: 0; Average of events per second: 0.000.\n2024-09-06T15:30:59.383 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725616853882):Number of requests made: 1; Number of events received: 0; Number of duplicated events filtered out: 0; Number of events generated and sent: 0; Average of events per second: 0.000.\n2024-09-06T15:30:59.383 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> The data is up to date!","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful collector’s execution (this is, no error logs were found), you should be able to see the following log message:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T15:30:59.382 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725616853882):Number of requests made: 1; Number of events received: 0; Number of duplicated events filtered out: 0; Number of events generated and sent: 0; Average of events per second: 0.000.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"@devo_pulling_id","type":"text","marks":[{"type":"code"}]},{"text":" value is injected into each event to allow grouping all events ingested by the same pull action. You can use it to get the exact events downloaded on that ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action in the ","type":"text"},{"text":"Data Search","type":"text","marks":[{"type":"strong"}]},{"text":" area of Devo.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"This service makes use of persistence. You can check how to restart it ","type":"text"},{"text":"above","type":"text","marks":[{"type":"link","attrs":{"href":"https://devoinc.atlassian.net/wiki/spaces/IF/pages/3577118721#Restart-the-persistence"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Incidents Service"},"content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Table ","type":"text"},{"text":"edr.cortex_xdr.alerts","type":"text","marks":[{"type":"code"}]},{"text":" has been deprecated. Now, the data of incident Alerts (","type":"text"},{"text":"v1/incident/get_incident_alert_data)","type":"text","marks":[{"type":"code"}]},{"text":" is ingested in the table ","type":"text"},{"text":"edr.cortex_xdr.incident_alert","type":"text","marks":[{"type":"code"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify data collection","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful initial run has the following output messages for the puller module:","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Note that the ","type":"text"},{"text":"PrePull","type":"text","marks":[{"type":"code"}]},{"text":" action is executed only one time before the first run of the ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:13:57.587 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Pull Started\n2024-09-06T17:13:57.588 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> start time_stamp to fetch the data is: 1724098800000 \n2024-09-06T17:13:59.093 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623037578):Number of requests made: 1; Number of events received: 15; Number of duplicated events filtered out: 0; Number of events generated and sent: 15; Average of events per second: 9.958.\n2024-09-06T17:13:59.094 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Sent 15 events to Devo.\n2024-09-06T17:13:59.095 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623037578):Number of requests made: 1; Number of events received: 15; Number of duplicated events filtered out: 0; Number of events generated and sent: 15; Average of events per second: 9.950.\n2024-09-06T17:13:59.095 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623037578):Number of requests made: 1; Number of events received: 15; Number of duplicated events filtered out: 0; Number of events generated and sent: 15; Average of events per second: 9.948.\n2024-09-06T17:13:59.095 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> The data is up to date!\n2024-09-06T17:13:59.096 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Data collection completed. Elapsed time: 1.518 seconds. Waiting for 58.482 second(s) until the next one","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful collector’s execution (this is, no error logs were found), you should be able to see the following log message:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:13:59.095 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623037578):Number of requests made: 1; Number of events received: 15; Number of duplicated events filtered out: 0; Number of events generated and sent: 15; Average of events per second: 9.948.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"@devo_pulling_id","type":"text","marks":[{"type":"code"}]},{"text":" value is injected into each event to allow grouping all events ingested by the same pull action. You can use it to get the exact events downloaded on that ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action in Loxcope.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"This service makes use of persistence. You can check how to restart it ","type":"text"},{"text":"above","type":"text","marks":[{"type":"link","attrs":{"href":"https://devoinc.atlassian.net/wiki/spaces/IF/pages/edit-v2/4490625032#Restart-the-persistence"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Audit manegements Service (New Service)"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo categorization and destination","type":"text"}]},{"type":"paragraph","content":[{"text":"All events of this service are ingested into table ","type":"text"},{"text":"edr.cortex_xdr.audit_management","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify data collection","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful initial run has the following output messages for the puller module:","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Note that the ","type":"text"},{"text":"PrePull","type":"text","marks":[{"type":"code"}]},{"text":" action is executed only one time before the first run of the ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:17:05.936 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Pull Started\n2024-09-06T17:17:05.939 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> start time_stamp to fetch the data is: 1725623165933 \n2024-09-06T17:16:09.137 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623165933):Number of requests made: 1; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 0.627.\n2024-09-06T17:16:09.139 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Sent 2 events to Devo.\n2024-09-06T17:16:09.143 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623165933):Number of requests made: 1; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 0.626.\n2024-09-06T17:16:09.145 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623165933):Number of requests made: 1; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 0.626.\n2024-09-06T17:17:09.094 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> The data is up to date!\n2024-09-06T17:17:09.094 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Data collection completed. Elapsed time: 3.160 seconds. Waiting for 56.840 second(s) until the next one","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful collector’s execution (this is, no error logs were found), you should be able to see the following log message:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:16:09.145 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,audit_managements#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623165933):Number of requests made: 1; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 0.626.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"@devo_pulling_id","type":"text","marks":[{"type":"code"}]},{"text":" value is injected into each event to allow grouping all events ingested by the same pull action. You can use it to get the exact events downloaded on that ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action in Loxcope.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"This service makes use of persistence. You can check how to restart it ","type":"text"},{"text":"above","type":"text","marks":[{"type":"link","attrs":{"href":"https://devoinc.atlassian.net/wiki/spaces/IF/pages/edit-v2/4490625032#Restart-the-persistence"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"All Alerts Service (New Service)"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo categorization and destination","type":"text"}]},{"type":"paragraph","content":[{"text":"All events of this service are ingested into table ","type":"text"},{"text":"edr.cortex_xdr.all_alert","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verify data collection","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful initial run has the following output messages for the puller module:","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Note that the ","type":"text"},{"text":"PrePull","type":"text","marks":[{"type":"code"}]},{"text":" action is executed only one time before the first run of the ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:24:44.923 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Pull Started\n2024-09-06T17:24:44.925 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> start time_stamp to fetch the data is: 1725308400000 \n2024-09-06T17:24:52.766 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623684899):Number of requests made: 1; Number of events received: 77; Number of duplicated events filtered out: 0; Number of events generated and sent: 77; Average of events per second: 9.819.\n2024-09-06T17:24:52.767 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Sent 77 events to Devo.\n2024-09-06T17:24:52.768 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1725623684899):Number of requests made: 1; Number of events received: 77; Number of duplicated events filtered out: 0; Number of events generated and sent: 77; Average of events per second: 9.817.\n2024-09-06T17:24:52.768 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623684899):Number of requests made: 1; Number of events received: 77; Number of duplicated events filtered out: 0; Number of events generated and sent: 77; Average of events per second: 9.816.\n2024-09-06T17:24:52.769 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> The data is up to date!\n2024-09-06T17:24:52.770 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Data collection completed. Elapsed time: 7.871 seconds. Waiting for 52.129 second(s) until the next one","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful collector’s execution (this is, no error logs were found), you should be able to see the following log message:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T17:24:52.768 INFO InputProcess::CortexXdrBasePuller(cortex_xdr#1243598,all_alerts#predefined) -> Statistics for this pull cycle (@devo_pulling_id=1725623684899):Number of requests made: 1; Number of events received: 77; Number of duplicated events filtered out: 0; Number of events generated and sent: 77; Average of events per second: 9.816.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"@devo_pulling_id","type":"text","marks":[{"type":"code"}]},{"text":" value is injected into each event to allow grouping all events ingested by the same pull action. You can use it to get the exact events downloaded on that ","type":"text"},{"text":"Pull","type":"text","marks":[{"type":"code"}]},{"text":" action in Loxcope.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"This service makes use of persistence. You can check how to restart it ","type":"text"},{"text":"above","type":"text","marks":[{"type":"link","attrs":{"href":"https://devoinc.atlassian.net/wiki/spaces/IF/pages/edit-v2/4490625032#Restart-the-persistence"}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Collector operations","type":"text"}]},{"type":"paragraph","content":[{"text":"This section is intended to explain how to proceed with specific operations of this collector.","type":"text"}]},{"type":"expand","attrs":{"title":"Verify collector operations"},"content":[{"type":"paragraph","content":[{"text":"The initialization module is in charge of setup and running the input (pulling logic) and output (delivering logic) services and validating the given configuration.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Initialization"},"content":[{"type":"paragraph","content":[{"text":"The initialization module is in charge of setup and running the input (pulling logic) and output (delivering logic) services and validating the given configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful run has the following output messages for the initializer module, including all services together:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T15:07:25.139 INFO MainProcess::MainThread -> Started all objects from \"MainProcess\" process\n2024-09-06T15:07:25.144 INFO InputProcess::MainThread -> Process started (pid=19803, ppid=19784, multiprocessing.start_method=\"fork\")\n2024-09-06T15:07:25.220 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;standard_senders;devo_1.json.gz\n2024-09-06T15:07:25.223 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.224 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5bdbabbd30e1988d6e2b0b74b6ec3289\"\n2024-09-06T15:07:25.227 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;incidents;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.231 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.231 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/6a3859facec8d617720d39590e169164\"\n2024-09-06T15:07:25.232 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/c620dfb5bdc3fc1a386e4924e99aa3e7\"\n2024-09-06T15:07:25.232 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;standard_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/6a3859facec8d617720d39590e169164\"\n2024-09-06T15:07:25.233 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/c620dfb5bdc3fc1a386e4924e99aa3e7\"\n2024-09-06T15:07:25.235 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.235 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/b1ee30ea2c4b3be1eb50c8b2ca80d8d8\"\n2024-09-06T15:07:25.235 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.236 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.238 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputStandardConsumer;standard_senders;0.json.gz\n2024-09-06T15:07:25.241 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.241 INFO OutputProcess::MainThread -> OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/de28663278a264d05d531fbc1db51a93\"\n2024-09-06T15:07:25.242 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.243 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;lookup_senders;devo_1.json.gz\n2024-09-06T15:07:25.246 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.246 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/a28c135f3fc69ece87d8fc2fdb029e8c\"\n2024-09-06T15:07:25.251 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;lookup_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.252 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.253 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.253 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/df8895fef2a509cbd87fcc9850dc0c81\"\n2024-09-06T15:07:25.255 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputLookupConsumer;lookup_senders;0.json.gz\n2024-09-06T15:07:25.256 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.257 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.257 INFO OutputProcess::MainThread -> OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/865a79c1b99ad39b22becc235c9732cb\"\n2024-09-06T15:07:25.259 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.259 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSenderManager;internal_senders;devo_1.json.gz\n2024-09-06T15:07:25.260 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.260 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.261 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.261 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.261 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.261 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/e784c94a6fe28de5937e50674407d82e\"\n2024-09-06T15:07:25.265 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,incidents#predefined) Finalizing the execution of init_variables()\n2024-09-06T15:07:25.265 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/DevoSender;internal_senders;devo_sender_0.json.gz\n2024-09-06T15:07:25.268 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.268 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/4ff7b345dc444ac050cf75f93e5dcb3b\"\n2024-09-06T15:07:25.269 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/cortex_xdr;1243598;alerts;predefined;CortexXdrBasePuller.json\n2024-09-06T15:07:25.271 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Created persistence instance, filename_path: /home/md_tausif/gitlab/devo-collector-cortex-xdr/state/not_used/OutputInternalConsumer;internal_senders;0.json.gz\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/50e7b9f5b3320841b223e83e5b156b5f\"\n2024-09-06T15:07:25.272 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] There is no data persisted with the latest format, any previous persisted data will be migrated\n2024-09-06T15:07:25.272 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5a07c27e666ce7c4400ef58d5b89f174\"\n2024-09-06T15:07:25.273 INFO OutputProcess::MainThread -> OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] No previous persistence file exists to migrate (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/10dd360c86621afd5a28a029a0dddcf6\"\n2024-09-06T15:07:25.273 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] Checking if old persisted data must be removed\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 2), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/50e7b9f5b3320841b223e83e5b156b5f\"\n2024-09-06T15:07:25.274 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) -> [PERSISTENCE_SYSTEM] No previous persistence file exists (Version 1), filename_path: \"/home/md_tausif/gitlab/devo-collector-cortex-xdr/state/5a07c27e666ce7c4400ef58d5b89f174\"\n2024-09-06T15:07:25.274 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(standard_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.275 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.275 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) Starting the execution of init_variables()\n2024-09-06T15:07:25.275 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.276 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.276 INFO InputProcess::MainThread -> Validating service metadata\n2024-09-06T15:07:25.276 INFO OutputProcess::MainThread -> DevoSender(lookup_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.277 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(lookup_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.279 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.279 INFO OutputProcess::DevoSenderManager(standard_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.279 INFO OutputProcess::MainThread -> DevoSenderManager(lookup_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.279 INFO InputProcess::MainThread -> Validating defined module definition\n2024-09-06T15:07:25.280 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.280 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.280 INFO OutputProcess::MainThread -> DevoSender(internal_senders,devo_sender_0) -> Starting thread\n2024-09-06T15:07:25.282 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(internal_senders,devo_1) -> Starting thread (every 300 seconds)\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputStandardConsumer(standard_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.01\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.283 INFO OutputProcess::OutputLookupConsumer(lookup_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.285 INFO OutputProcess::MainThread -> DevoSenderManager(internal_senders,manager,devo_1) -> Starting thread\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(lookup_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.01\n2024-09-06T15:07:25.285 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.286 INFO OutputProcess::OutputInternalConsumer(internal_senders_consumer_0) -> [EMERGENCY_PERSISTENCE_SYSTEM] Recovering any available content from the persistence system\n2024-09-06T15:07:25.287 INFO InputProcess::MainThread -> Validating common input config\n2024-09-06T15:07:25.289 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Nothing available in the persistence system\n2024-09-06T15:07:25.289 INFO OutputProcess::DevoSenderManager(internal_senders,manager,devo_1) -> [EMERGENCY_PERSISTENCE_SYSTEM] Elapsed seconds: 0.00\n2024-09-06T15:07:25.294 INFO InputProcess::MainThread -> Validating service input config\n2024-09-06T15:07:25.298 INFO InputProcess::MainThread -> Running overriding rules\n2024-09-06T15:07:25.299 INFO InputProcess::MainThread -> Validating the rate limiter config given by the user\n2024-09-06T15:07:25.300 INFO InputProcess::MainThread -> setting has not been defined. The generic settings will be used instead.\n2024-09-06T15:07:25.301 INFO InputProcess::MainThread -> Adding raw config to the collector store\n2024-09-06T15:07:25.302 INFO InputProcess::MainThread -> Running custom validation rules\n2024-09-06T15:07:25.302 INFO InputProcess::MainThread -> CortexXdrBasePuller(cortex_xdr#1243598,alerts#predefined) Finalizing the execution of init_variables()","type":"text"}]}]},{"type":"expand","attrs":{"title":"Events delivery and Devo ingestion"},"content":[{"type":"paragraph","content":[{"text":"The event delivery module is in charge of receiving the events from the internal queues where all events are injected by the pullers and delivering them using the selected compatible delivery method.","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful run has the following output messages for the initializer module:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-09-06T15:32:47.810 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,devo_1) -> Number of available senders: 1, sender manager internal queue size: 0\n2024-09-06T15:32:47.810 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,devo_1) -> enqueued_elapsed_times_in_seconds_stats: {}\n2024-09-06T15:32:47.810 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,devo_1) -> Sender: DevoSender(lookup_senders,devo_sender_0), status: {\"internal_queue_size\": 0, \"is_connection_open\": False}\n2024-09-06T15:32:47.811 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,devo_1) -> Lookup - Total number of messages sent: 0, messages sent since \"2024-09-06 09:57:47.810025+00:00\": 0 (elapsed 0.000 seconds)","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"By default, these information traces will be displayed every 10 minutes.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Sender statistics","type":"text"}]},{"type":"paragraph","content":[{"text":"Each service displays its own performance statistics that allow checking how many events have been delivered to Devo by type:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"abdb5018-c5cb-44fe-a5e5-b113cacdf084"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[278.0]},"content":[{"type":"paragraph","content":[{"text":"Logging trace","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[278.0]},"content":[{"type":"paragraph","content":[{"text":"Number of available senders: 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"Displays the number of concurrent senders available for the given Sender Service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[278.0]},"content":[{"type":"paragraph","content":[{"text":"sender manager internal queue size: 0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"Displays the items available in the internal sender queue.","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This value helps detect bottlenecks and needs to increase the performance of data delivery to Devo. This last can be made by increasing the concurrent senders.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[278.0]},"content":[{"type":"paragraph","content":[{"text":"Total number of messages sent: 0, messages sent since \"2024-09-06 09:57:47.810025+00:00\": 0 (elapsed 0.000 seconds)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[452.0]},"content":[{"type":"paragraph","content":[{"text":"Displayes the number of events from the last time and following the given example, the following conclusions can be obtained:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"0 events were sent to Devo since the collector started.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The last checkpoint timestamp was ","type":"text"},{"text":"2024-09-06 09:57:47.810025+00:00","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"0 events where sent to Devo between the last UTC checkpoint and now.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Those 0 events required ","type":"text"},{"text":"0.000 seconds","type":"text","marks":[{"type":"code"}]},{"text":" to be delivered.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"By default these traces will be shown every 10 minutes.","type":"text"}]}]}]}]}]},{"type":"paragraph"},{"type":"paragraph"}]},{"type":"expand","attrs":{"title":"Check memory usage"},"content":[{"type":"paragraph","content":[{"text":"To check the memory usage of this collector, look for the following log records in the collector which are displayed every 5 minutes by default, always after running the memory-free process.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Some collectors can be tuned to reduce the memory impact when pulling data in large infrastructures.","type":"text"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The used memory is displayed by running processes and the sum of both values will give the total used memory for the collector.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The global pressure of the available memory is displayed in the ","type":"text"},{"text":"global","type":"text","marks":[{"type":"code"}]},{"text":" value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Al metrics (Global, RSS, VMS) include the value before freeing and after: ","type":"text"},{"text":"previous -> after freeing memory","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"codeBlock","content":[{"text":"2024-09-06T15:07:25.494 INFO InputProcess::MainThread -> [GC] global: 42.1% -> 42.1%, process: RSS(41.61MiB -> 41.73MiB), VMS(1.05GiB -> 1.05GiB)\n2024-09-06T15:09:25.375 INFO OutputProcess::MainThread -> [GC] global: 42.4% -> 42.4%, process: RSS(44.46MiB -> 44.46MiB), VMS(929.14MiB -> 929.14MiB)","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Differences between ","type":"text"},{"text":"RSS","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"VMS","type":"text","marks":[{"type":"code"}]},{"text":" memory usage:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RSS","type":"text","marks":[{"type":"code"}]},{"text":" is the Resident Set Size, which is the actual physical memory the process is using","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"VMS","type":"text","marks":[{"type":"code"}]},{"text":" is the Virtual Memory Size which is the virtual memory that process is using","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Enable/disable the logging debug mode"},"content":[{"type":"paragraph","content":[{"text":"Sometimes it is necessary to activate the debug mode of the collector's logging. This debug mode increases the verbosity of the log and allows you to print execution traces that are very helpful in resolving incidents or detecting bottlenecks in heavy download processes.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To enable this option you just need to edit the configuration file and change the debug_status parameter from false to true and restart the collector.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To disable this option, you just need to update the configuration file and change the debug_status parameter from true to false and restart the collector.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For more information, visit the configuration and parameterization section corresponding to the chosen deployment mode.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Troubleshooting"},"content":[{"type":"paragraph","content":[{"text":"This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the common errors for the current services.","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"5b1f20f2-0acc-49a7-85a5-56bdb3ccede4"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"Error type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"Error ID","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Error message","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Cause","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Solution","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"SetupError","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"100","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP Error occurred while checking the server health for cortex from remote source: {e}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"You will get the status code with error msg.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that the collector has the necessary permissions and proper credentials to access the Cortex xdr API and contact the developer with exact error message","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"PullError","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"300","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Error while fetching the event data for service {service_name} and error: {e}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"You will get the status code with error msg.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"This is an internal issue. Contact with Devo Support team.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":10,"colwidth":[108.0]},"content":[{"type":"paragraph","content":[{"text":"ApiError","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"400","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 400: Bad request: The server could not understand the request","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Bad Request","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach out to the developer","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"401","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 401: Unauthorized: Authentication is required and has failed or has not been provided","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Credentials provided is not correct","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Please check and provide the correct credentials","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"402","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Unauthorized access. User does not have the required license type to run this API","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"User doesn't have the required permission","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly get required permission and reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"403","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 500: Server Error: An error occurred on the server","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Internal server error. An unverified status of API communication type error","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"404","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Request Error: Received status code {status_code}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"You will get the status code with error msg.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"405","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Number of request has exceeded for the cortex api","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"406","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Number of request has exceeded for the cortex api","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"407","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"Number of request has exceeded for the cortex api","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"408","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP Error occurred while retrieving events from cortex server, summary: {str(e)}, details: {details_str}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"You will get the status code with error msg","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[119.0]},"content":[{"type":"paragraph","content":[{"text":"409","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Some error occurred while retrieving events from cortex server. Error details {str(e)}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[175.0]},"content":[{"type":"paragraph","content":[{"text":"You will get the status code with error msg","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"transparent","rowspan":1,"colwidth":[159.0]},"content":[{"type":"paragraph","content":[{"text":"Kindly reach the developer with the exact msg.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Change log","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"7f3c0c3d-8ab1-4581-99a9-dd42f916ca6e"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"Release","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"Released on","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Release type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, #F4F5F7)","rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Recommendations","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v2.0.4","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1737072000000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"75e7023a-e734-4fae-87d4-e2ebd8075009"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Recommended version","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Bug Fix","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed the duplication issue in the incidents service.","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v2.0.3","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1733270400000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"1788d7f7-010e-4238-8949-0f9024936087"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added 2 new puller and a base puller","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved unit tests to added some extra tests","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added checks for validating the start_time and if the time is not in future","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v2.0.2","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1730937600000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"e19e5f61-9d33-4d11-a0fe-1d7f1a8c535f"}},{"type":"hardBreak"},{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"e8072aad-2031-4611-92ed-ce6782e5caef"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[144.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DCSDK from 1.12.4 to 1.13.1","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed bug related to module_global_status value in message_metrics","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PEP8 Cleanup","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New metric endpoint (","type":"text"},{"text":"http://0.0.0.0:3000/metrics","type":"text","marks":[{"type":"link","attrs":{"href":"http://0.0.0.0:3000/metrics"}}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed some metric structure that were already sent to Devo before (devo.collector.metric.*)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved MacOS compatibility (for the development phase)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DevoSDK to version 6.0.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Puller and PullerSetup now have the same id structure","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed some console log traces to DEBUG","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed bug related to rate_limiter object (the object was not properly internally released)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved Filesystem persistence behavior","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New libraries installed:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"uvicorn==0.31.1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"fastapi==0.115.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated libraries:","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"jsonschema==4.19.1 -> jsonschema==4.23.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"psutil==5.9.6 -> psutil==5.9.8","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"python-dateutil==2.8.2 -> python-dateutil==2.9.0.post0","type":"text"}]}]}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Bug","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Modified paging logic so that the collector responds correctly to controlled stops.","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v2.0.1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1727654400000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"48762a46-ed4c-4ce1-97bf-65f397325cac"}}]},{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"4daadb24-7bbb-42af-be17-371bb1e549ca"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"upgraded the docker base image to 1.3.1","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Bug fixing","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added condition to resolve the infinite issue","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v2.0.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1725580800000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"982a9500-fd6f-4c6d-87b4-b026d8b961c2"}}]},{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"c92fd728-da5f-4b42-a88e-bb6c5d8767bd"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added new services: ","type":"text"},{"text":"audit_management","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"all_alert","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Modified the table of incident alert.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Removed the usage of alert multi event table.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Using v2 API for alert service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unified all the puller services in a single puller.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Moved ","type":"text"},{"text":"api_endpoint","type":"text","marks":[{"type":"code"}]},{"text":" in the collector definition.","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v1.4.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1724371200000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"a960930e-0e9c-465b-aea4-2b4bfe7940bd"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added ","type":"text"},{"text":"start_time","type":"text","marks":[{"type":"code"}]},{"text":" as an optional parameters for both of the services.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added deduplication logic for both services","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated Docker image base to version ","type":"text"},{"text":"v1.3.0","type":"text","marks":[{"type":"code"}]},{"text":" in Dockerfile","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DCSDK from ","type":"text"},{"text":"v1.11.1","type":"text","marks":[{"type":"code"}]},{"text":" to ","type":"text"},{"text":"v1.12.4","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added new sender for relay in house + TLS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added persistence functionality for gzip sending buffer","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added Automatic activation of gzip sending","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved behaviour when persistence fails","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgraded DevoSDK dependency","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed console log encoding","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restructured python classes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved behaviour with non-utf8 characters","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Decreased defaut size value for internal queues (Redis limitation, from 1GiB to 256MiB)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New persistence format/structure (compression in some cases)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Removed dmesg execution (It was invalid for docker execution)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Applied changes to make DCSDK compatible with MacOS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved behavior with non-utf8 characters","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Decreased defaut size value for internal queues (Redis limitation, from 1GiB to 256MiB)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New persistence format/structure (compression in some cases)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Removed dmesg execution (It was invalid for docker execution)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"DevoSDK has been updated to version 5.4.0","type":"text"}]}]}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v1.3.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1716422400000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"1642ee75-2760-4c80-baff-c4c9ca8a5c14"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgrade DC SDK to the latest version 1.11.1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgrade the Docker base image to 1.2.0","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[144.0]},"content":[{"type":"paragraph","content":[{"text":"v1.2.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1710892800000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"IMPROVEMENT","localId":"1fe38a97-2b77-49ec-b902-35fa18f23c40"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Initial version","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[183.0,185.0,248.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added 'start_time' in config file for alerts service","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added logs","type":"text"}]}]}]}]}]}]}]}],"version":1}

Browser not supported