USM Anywhere™

Sensor Disconnected from the USM Anywhere Service

Role Availability Read-Only Analyst Manager

USM Anywhere Sensors sometimes disconnect from the USM Anywhere service, for example, during an update process. When this happens, USM Anywhere informs users in a Manager role by email when a sensorSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect log and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation. has been disconnected from the service. USM Anywhere generates an event when a sensor is disconnected for more than 30 minutes. A new event is generated every 30 minutes until the sensor reconnects.

Note: Logs, including NXLog messages, are cached locally and will be forwarded to USM Anywhere when the connection resumes.

When a sensor disconnects from the USM Anywhere service, it sends an email notice within two hours to the email address used to sign into USM Anywhere. This notice informs you that your sensor is not connected. You can immediately take action to restore your service either by working with AT&T Cybersecurity Technical Support or by making an environmental, network connectivity change.

The notification will be generated daily until the sensor is reconnected. After seven days, the notifications will no longer be issued.

After your sensor reconnects, you will receive an email notification informing you that your service has been restored. Because of this automated notification, you do not have to log in to the product to check the sensor connection status. USM Anywhere generates an event when a sensor reconnects.

If you are not receiving notifications of a disconnection, or your notifications are being sent outside of the expected window, that could indicate issues in your control node. See View Network Testing Information for instructions on how to verify your control node's connection.