Not seeing any security events in the dashboard

Reply
Highlighted
L1 Bithead

Not seeing any security events in the dashboard

Hello all! I've had a strange thing happen in the Traps dashboard. No security events for an entire month. Not even low or medium. I find this hard to believe. I've just run the test malware file and it did pop up on the endpoint and it did report that in the dashboard, but there's nothing else! I see in the logs that files are being evaluated. I just upgraded everyone to 6.11 today. Still nothing. 

 

If I rewind a few months there were regular events being logged every day. 

 

Thoughts?

Tags (1)
L7 Applicator

Re: Not seeing any security events in the dashboard

@BrendanOConnell,

If you can run the test file on hosts and get detection events, then it stands to reason that you aren't actually getting any detentions. I might run the test file on a few different clients just to verify that they are all reporting in properly, but it kind of sounds like your agents are behaving as expecting and aren't having an issue communicating with the portal.

L1 Bithead

Re: Not seeing any security events in the dashboard

I know, logically that stands to reason! I just know that the first few months we had this going we at least were getting some low and medium events. Now there's like nothing at all. Makes me suspicious...

L7 Applicator

Re: Not seeing any security events in the dashboard

@BrendanOConnell,

The only other thing I could think of that would cause this behavior is if someone made modifications to your Profiles and set the action mode to Disabled. 

L1 Bithead

Re: Not seeing any security events in the dashboard

I checked the default security profiles and they all look good. I also gave it another month and still, no security events (except for my tests) whatsoever. I'm at a loss. The clients are almost all on 6.12. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!