Need to create a alarm when ERC is down and also similar for the other component in the SIEM
Please help in creating alarm for the same.
In the ESM alarms page, create an alarm with type "Device Status Change" checking the appropriate boxes (likley warning, critical, and connection) and set the devices you want to be alerted on.
if it's done, you can use device failure. not receiving logs I need this too, but from previous experience, the built-in status alarm doesn't work.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center