Difference between system reboot and agent services off

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Difference between system reboot and agent services off

L1 Bithead

Hi,

 

We have to configure 3 alerts that are sent via email.

 

Condition 1:

When cortex agent services are stopped then raise an alert via email.

 

Condition 2:

When system is powered off/turned off then wait will 10 minutes, if systems do not come back in Powered on status, then raise an alert via email.

 

Condition:

When there are 10/20 systems (in quantity) suddenly powered off then raise an alert via email.

 

Thank you.

 

1 REPLY 1

L5 Sessionator

Hello @I.Naseer 

 

Thanks for reaching out on LiveCommunity!

For condition one you can create notification and then choosing Agent audit logs as log type. Then apply below conditions to trigger an email notification.

Category = Status

Type = Agent status

Sub type = Stop

 

For condition 2 and 3, you can write correlation rule based on below XQL query and building out your use case further. Then email notifications can be configured based on alerts.

dataset = xdr_data
| filter event_type = ENUM.AGENT_STATUS and event_sub_type = ENUM.AGENT_STATUS_AGENT_SHUTDOWN

 

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

  • 566 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!