topic Re: Not seeing any security events in the dashboard in General Topics

Not seeing any security events in the dashboard

BrendanOConnell — Tue, 15 Oct 2019 22:09:02 GMT

Hello all! I've had a strange thing happen in the Traps dashboard. No security events for an entire month. Not even low or medium. I find this hard to believe. I've just run the test malware file and it did pop up on the endpoint and it did report that in the dashboard, but there's nothing else! I see in the logs that files are being evaluated. I just upgraded everyone to 6.11 today. Still nothing.

If I rewind a few months there were regular events being logged every day.

Thoughts?

Re: Not seeing any security events in the dashboard

BPry — Wed, 16 Oct 2019 17:57:16 GMT

@BrendanOConnell,

If you can run the test file on hosts and get detection events, then it stands to reason that you aren't actually getting any detentions. I might run the test file on a few different clients just to verify that they are all reporting in properly, but it kind of sounds like your agents are behaving as expecting and aren't having an issue communicating with the portal.

Re: Not seeing any security events in the dashboard

BrendanOConnell — Wed, 16 Oct 2019 19:55:30 GMT

I know, logically that stands to reason! I just know that the first few months we had this going we at least were getting some low and medium events. Now there's like nothing at all. Makes me suspicious...

Re: Not seeing any security events in the dashboard

BPry — Wed, 16 Oct 2019 21:46:58 GMT

@BrendanOConnell,

The only other thing I could think of that would cause this behavior is if someone made modifications to your Profiles and set the action mode to Disabled.

Re: Not seeing any security events in the dashboard

BrendanOConnell — Wed, 13 Nov 2019 22:41:43 GMT

I checked the default security profiles and they all look good. I also gave it another month and still, no security events (except for my tests) whatsoever. I'm at a loss. The clients are almost all on 6.12.