Enable more granular Non-Reporting Log Source Escalations
A
Andrew Yim
Currently, Non-Reporting Log Source Escalations are global and will create notifications for endpoints that hit the configured non-report window. This creates unnecessary noise for clients with expected inactive/shelved endpoints. Please allow the setting "Escalate Non-Reporting Data Sources" to be scoped for individual organizations and/or endpoints.
A
Aaron Ward
How about we add some additional levels of ignore. 8 hrs. is the max now, but what about 1 Day, 7 Days, 30 Days?
Autopilot
Merged in a post:
Non-reporting Log source escalation improvement
S
Sokratis Siozos-Drosos
The Non-Reporting Log Source escalation requires 7 days of hourly reporting before a source qualifies. Is this correctly understood? GitLab audit events are too sparse to ever qualify. Can you monitor ingestion for low-volume sources, or set a per-source threshold?
Thanks
E
Evan Swendsen
Ideally at a policy level, it would be good to have different classes of devices have different policies too. Like a workstation not reporting because it's off is expected and depending on use cases, doesn't need an alert. But a SYSLOG source (firewall etc) or server not reporting would constitute an issue.
Autopilot
Merged in a post:
SIEM audit log failure threshold per-organization setting.
D
Darren Quante
Currently the threshold for when to report a SIEM source as non-reporting is a global setting. We have clients under us who have different compliance requirements and tolerances for non-reporting SIEM sources. We should be able to set this threshold per organization rather than globally to accommodate different requirements.