Broker Helath Checking

[M.Soares909225]

Hello everyone!

I working in a environment that have some broker clusters and local brokers as well, I would like know how I can implement some way to have a daily health checking for these brokers, like if the broker is need a reboot to update, if I don't have any Gaps in receiving logs (for example the last logs received was one day ago) etc. and create a dashboard with that and also notify by e-mail.

[amcdonal363]

On your 3.x tenant, go to:  https://<tenant_url>/auditing (This brings you to the Management Audit Logs)

• Where you can track your Broker VM activities as per:
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Monitor-Broker-VM...
  • Filter by: Type = "Broker VMs"
    • Notice that no audit event is received when a Broker VM has been upgraded.
    • Notice that no audit event is received when a Broker VM enters as state of needing a reboot.

Note: There is no dataset dedicated to receiving any sort of events from the Broker VM itself.

The best practice would be the SIEM admin to check the https://<tenant_url>/configuration/broker-vms/brokers UI every Monday morning to see if an upgrade is available or a reboot is required to apply an update which is applied automatically.

For monitoring health of data ingestions, first ensure Data Ingestion Monitoring is enabled in https://<tenant_url>/configuration/general; then create correlation rules to monitor these ingestion metrics:

• Documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Overview-of-data-...
• Examples: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Creating-correlat...

[PA_nts]

Bit late to the party.. but agree.. the default health checks in my opinion is not great..

we have correlation rules that will detect broker-vm applet errors and disconnects - when this happens it will generate an alert in the health domain and our guys are notified.

When a Broker-VM loses connectivity to the XSIAM tenant you can use the following query in a correlation rule:

dataset = saas_audit_logs  

| filter operation_name_orig = "BROKER_VM:Disconnect"

When a Broker-VM applet loses connectivity to one of the connectors/applets you can use the following query in a correlation rule:

config case_sensitive = true |
dataset = collection_auditing

| filter classification = "ERROR"
| comp latest(_time) by collector_type , instance , classification ,description, _broker_ip_address, _broker_device_name, _broker_device_id

the correlation rule you can define to what suits you best..