Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

SIEM Connector is occasionally falling behind

SIEM Connector is occasionally falling behind

Version

Cb Defense (formerly Confer) - All

Issue

SIEM Connector is occasionally falling behind.

Symptom

Notification received from SIEM Connector are delayed.

Cause

The current architecture of the SIEM connector is such that it polls the sever for new events on a fixed interval (5 min default/recommended) and downloading a fixed number of events each time. Occasional burst in event volume may case connector to fall behind, because there are too many events queued up on the server side.

Solution

In many cases, the SIEM connector will catch up over a period of time as the volume of events goes down back.

In some cases, adjusting the poll interval (not less than 5 minutes) and/or download size may be needed to make the connector catch up.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-15-2016
Views:
497
Contributors