Inactive Device - One by one?

[Mayhaps]

We have many devices in our SIEM (1k+) across several receivers. I have a list of devices (around 500) that I want to watch to see if they become inactive. Currently it seems that I can either select a whole receiver (which would also capture devices that are not in my list) or pick devices, one-by-one.

There has to be a better way of doing this. How can I better select devices to detect inactive status?

[SSSSYYYY]

Upgrade advisor will check data sources and work out when it became inactive, which maybe helpful?

[pbpillai]

In ESM propertries>Alarms page, there will be an alarm called 'Device Health' with condition as Device Status Change.

Please make sure Idle time is selected.

Prior to doing this, you also need to ensure in Receiver properties>Events,Flows & logs> Inactivity Settings are configured for each of the datasources under each devices by clicking on the Inactivity Settings button.

You can set the inactivity time for each datasource.

Like, say for example if for 30 minutes, you do not receive any events from a datasource, the datasource will be marked as inactive.

A yellow flag will be displayed in the ESM GUI for the inactive datasource highlighting the inactivity status.

When we start to receive events from the datasource, the inactivity status yellow flag will disappear.

In the 'Escalation' tab of the Alarm, you can enable Generate Reports & specify the conditions for the report.

The datasources need to be selected under the respective device in the 'Devices' tab of the Alarm as well.

Then you can get a report generated at a particular time of the day that shows the Inactivity status.

Regards,

Prashanth B Pillai

McAfee Technical Support

Customer Success Group