Broker-VM disconnet alert notification

[PA_nts]

Hi All,

anyi dea how i can generate an alert when a broker-vm gets disconnected?

Has anyone managed to create a correlation rule that will alert if a Broker-VM gets disconnected from XSIAM?

the xsiam documentation states that 'To help you monitor your Broker VM version, connectivity, and high availability clusters, Cortex XSIAM sends notifications to your Cortex XSIAM console Notification Center' but this does not help me much. 

Additionally you can setup email notification but i don't want that.. instead we have an integration to a backend helpdesk ticket system, so that when an alert is created in xsiam, it sends the incident/alert payload and it then generates a ticket on our backend helpdesk and engineers will be assigned.

we use this currently for datasources and ngfw devices that stops sending logs.

thanks in adv

[PA_nts]

To Add..

If i create a xql query as per below.. it shows me the applets within the broker-vm if they are in an ERROR state

note i did this as case sensitive to filter out unwanted error alerts from other datasources.. i am specifically looking for 'broker-vm' issues.

config case_sensitive = true |
dataset = collection_auditing
| filter classification = "ERROR"
| comp latest(_time) by collector_type , instance , classification ,description, _broker_ip_address, _broker_device_name, _broker_device_id

however.. this will not alert if the broker-vm is disconnected. so still working on that portion.

cheers

[Vinay-AS]

Hello,

You can identify disconnected Broker VMs by creating a correlation rule with the following query.

dataset = management_auditing
| filter description contains "Broker VM"
| filter subtype = "Disconnect"

Confirm if this works as expected.

Regards,

Vinay

[PA_nts]

Hi Vinay

thanks.. yes I have tried that also.. however I find it is not very efficient.. ie when a broker vm gets disconnected.. it can take some time for this correlation rule to pick this up.. i guess the disconnect only gets updated in the audit logs once the timeout threshold has been received. so in this case.. both queries seems give me the same result.

was hoping for something with less time delay.. but can work with it as is.

thanks

[A.BELKAHLA]

Hello,

i hope you re doing well , im working right now on on integration of cortex XDR to send case to our ticket system can you please share with me how you did it;
thanks for advance.

[PA_nts]

you can use the xql logic below.. 

dataset = management_auditing
| filter subtype = "Disconnect"
| alter host_name = arrayindex(regextract(description, "Broker VM\s([A-Za-z0-9_-]+)\s"), 0)
| alter device_id = arrayindex(regextract(description, "ID:\s([a-zA-Z0-9]+)"), 0)
| fields _time, host_name, device_id, description
| sort desc _time

then save it as a correlation rule and adapt the rule with suppression (24 hours), timeframe to seach, the fields you want in the description ie issue name: 'Broker-VM Disconnect Alert $host_name'

description - 'One or more Broker-VM's are in a disconnect state $host_name' etc etc.. lots of options.. just needs to find waht works best for you.

the correlation rule will trigger an alert when the broker gets disconnected.. you can then do an notification to email someone, or automation rule to send it to you ticketing backend.

cheers