Broker Helath Checking

[M.Soares909225]

Hello everyone!

I working in a environment that have some broker clusters and local brokers as well, I would like know how I can implement some way to have a daily health checking for these brokers, like if the broker is need a reboot to update, if I don't have any Gaps in receiving logs (for example the last logs received was one day ago) etc. and create a dashboard with that and also notify by e-mail.

[amcdonal363]

On your 3.x tenant, go to:  https://<tenant_url>/auditing (This brings you to the Management Audit Logs)

• Where you can track your Broker VM activities as per:
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Monitor-Broker-VM...
  • Filter by: Type = "Broker VMs"
    • Notice that no audit event is received when a Broker VM has been upgraded.
    • Notice that no audit event is received when a Broker VM enters as state of needing a reboot.

Note: There is no dataset dedicated to receiving any sort of events from the Broker VM itself.

The best practice would be the SIEM admin to check the https://<tenant_url>/configuration/broker-vms/brokers UI every Monday morning to see if an upgrade is available or a reboot is required to apply an update which is applied automatically.

For monitoring health of data ingestions, first ensure Data Ingestion Monitoring is enabled in https://<tenant_url>/configuration/general; then create correlation rules to monitor these ingestion metrics:

• Documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Overview-of-data-...
• Examples: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Creating-correlat...