Sensors Page Overview

Role Availability Read-Only Investigator Analyst Manager

The Sensors page enables you to add new sensors Sensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation., configure the deployed sensors, delete and redeploy sensors, and edit a sensor for modifying the name or description. Go to Data Sources > Sensors to open the Sensors main page. The page displays the list of sensors you have deployed in your environment.

Sensors Main Page

The following table lists the default columns in the Sensors page.

List of the Default Columns in the Sensors Page
Column Field Name Description
Sensor Name Name of the deployed sensor. The type of sensor is displayed below the name.
Description Text identifying the sensor.
IP Address IP address assigned to the sensor.
Version Installed version of the sensor.
Connection Status

Status of the sensor, which can be the following:

Waiting for connection: The sensor has been added to the system, but it is not connected.

Connected: The sensor is connected, but it is still initializing and performing configurations.

Connection lost: The sensor has lost the connection. (Logs, including NXLog messages, are cached locally and will be forwarded to USM Anywhere when the connection resumes.)

Ready: The sensor is connected and configured.

Configured Icon to indicate if the sensor is configured () or not ().

The icon only displays when the sensor is not configured. Use this icon to go back to the wizard and finish the sensor configuration.

Use the icon to modify the sensor name or the sensor description. See Editing a Sensor for more information.

Use the icon to delete the sensor and deploy a new one. See Redeploying a Sensor for more information. You can also use this button to delete the sensor permanently. See Deleting a Sensor for more information.

You can also click a sensor to display the specific information about that sensor. See Configuring a Sensor for more information.

Sensors Running on an Outdated Version of USM Anywhere

USM Anywhere doesn't support sensors running on an outdated version of USM Anywhere. When USM Anywhere identifies a configured sensor running on an outdated version, a yellow announcement displays to warn you about it. See Configure Network Interfaces for On-Premises Sensors to confirm that the sensor on an outdated version meets the proper requirements and contact LevelBlue Technical Support for assistance.

Sensor on an outdated version