topic Re: Broker Helath Checking in Cortex XSIAM Discussions

Broker Helath Checking

M.Soares909225 — Wed, 10 Dec 2025 20:23:03 GMT

Hello everyone!

I working in a environment that have some broker clusters and local brokers as well, I would like know how I can implement some way to have a daily health checking for these brokers, like if the broker is need a reboot to update, if I don't have any Gaps in receiving logs (for example the last logs received was one day ago) etc. and create a dashboard with that and also notify by e-mail.

Re: Broker Helath Checking

amcdonal363 — Tue, 16 Dec 2025 19:34:00 GMT

On your 3.x tenant, go to: https://<tenant_url>/auditing (This brings you to the Management Audit Logs)

Where you can track your Broker VM activities as per:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Monitor-Broker-VM-activity
- Filter by: Type = "Broker VMs"
  - Notice that no audit event is received when a Broker VM has been upgraded.
  - Notice that no audit event is received when a Broker VM enters as state of needing a reboot.

Note: There is no dataset dedicated to receiving any sort of events from the Broker VM itself.

The best practice would be the SIEM admin to check the https://<tenant_url>/configuration/broker-vms/brokers UI every Monday morning to see if an upgrade is available or a reboot is required to apply an update which is applied automatically.

For monitoring health of data ingestions, first ensure Data Ingestion Monitoring is enabled in https://<tenant_url>/configuration/general; then create correlation rules to monitor these ingestion metrics:

Re: Broker Helath Checking

PA_nts — Thu, 15 Jan 2026 08:18:49 GMT

Bit late to the party.. but agree.. the default health checks in my opinion is not great..

we have correlation rules that will detect broker-vm applet errors and disconnects - when this happens it will generate an alert in the health domain and our guys are notified.

When a Broker-VM loses connectivity to the XSIAM tenant you can use the following query in a correlation rule:

dataset = saas_audit_logs

| filter operation_name_orig = "BROKER_VM:Disconnect"

When a Broker-VM applet loses connectivity to one of the connectors/applets you can use the following query in a correlation rule:

config case_sensitive = true |
dataset = collection_auditing

| filter classification = "ERROR"
| comp latest(_time) by collector_type , instance , classification ,description, _broker_ip_address, _broker_device_name, _broker_device_id

the correlation rule you can define to what suits you best..