This would fall under the "inactivity" alarms. You can create one by using the "device status change" alarm type and check the box for inactivity.
This is under the System Properties > Alarms, New alarm
Thank you very much Jon, For your quick help.
I am new to SIEM so please forgive my silly questions. I am using ESM version 9.4.2 & the setting you mentioned above doesn't have Inactivity option. All i can see under " device status change" Is WARNING,CRITICAL,CONNECTION,IDLE TIME. Not sure which will cover the requirement of not receiving logs from data source.
Hi again Vinay,
Idle time is what you're looking for
You can then set what devices you wish to apply the alarm to under the Devices tab.