Broker-VM disconnet alert notification

[PA_nts]

Hi All,

anyi dea how i can generate an alert when a broker-vm gets disconnected?

Has anyone managed to create a correlation rule that will alert if a Broker-VM gets disconnected from XSIAM?

the xsiam documentation states that 'To help you monitor your Broker VM version, connectivity, and high availability clusters, Cortex XSIAM sends notifications to your Cortex XSIAM console Notification Center' but this does not help me much. 

Additionally you can setup email notification but i don't want that.. instead we have an integration to a backend helpdesk ticket system, so that when an alert is created in xsiam, it sends the incident/alert payload and it then generates a ticket on our backend helpdesk and engineers will be assigned.

we use this currently for datasources and ngfw devices that stops sending logs.

thanks in adv

[PA_nts]

To Add..

If i create a xql query as per below.. it shows me the applets within the broker-vm if they are in an ERROR state

note i did this as case sensitive to filter out unwanted error alerts from other datasources.. i am specifically looking for 'broker-vm' issues.

config case_sensitive = true |
dataset = collection_auditing
| filter classification = "ERROR"
| comp latest(_time) by collector_type , instance , classification ,description, _broker_ip_address, _broker_device_name, _broker_device_id

however.. this will not alert if the broker-vm is disconnected. so still working on that portion.

cheers

[Vinay-AS]

Hello,

You can identify disconnected Broker VMs by creating a correlation rule with the following query.

dataset = management_auditing
| filter description contains "Broker VM"
| filter subtype = "Disconnect"

Confirm if this works as expected.

Regards,

Vinay

[PA_nts]

Hi Vinay

thanks.. yes I have tried that also.. however I find it is not very efficient.. ie when a broker vm gets disconnected.. it can take some time for this correlation rule to pick this up.. i guess the disconnect only gets updated in the audit logs once the timeout threshold has been received. so in this case.. both queries seems give me the same result.

was hoping for something with less time delay.. but can work with it as is.

thanks