USM Anywhere gives you the option of configuring a threshold after which asset inactivity is a concern. When your environment is not receiving events from an asset within the configured period of time, USM Anywhere generates monitoring events that display in the Events List View page. Since these events are not tied to any USM Anywhere Sensor that you have deployed, you will see a new sensor, with the name of your USM Anywhere subdomain, listed for these events. USM Anywhere will generate new monitoring events until the asset starts reporting again. You can see two types of monitoring events:
- Event from asset not received: Event details to include asset name. It includes the total disconnected time and when the last message was received.
- Event from asset received: Event details to include asset name.
Warning: Keep in mind that monitoring events are generated when your environment is not receiving events from an asset either because the asset is not sending events or because of a filtering rule. If you have a rule that filters events coming from an asset, from the perspective of USM Anywhere that asset is not sending events.
To configure the period of time
- Go to Environment > Assets.
- Next to the asset name whose details you want to review,
click the icon .
- Select Full Details.
- In the upper left side of the page, set a period of time in the Create event if asset stops sending data field by clicking the icon. You can select a predefined value between None, 1 hour, 6, 12, 24, 72 hours, 1 week, or 2 weeks.
Note: By default this field is configure to None.
- Click the icon to set the value.
The events are displayed in the Events List View page.
To see events created when an asset stops sending data