Regular Events and System Events

Role Availability Read-Only Investigator Analyst Manager

USM Anywhere provides a centralized view of regular events and system events Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall..

From now on, and during a grace period, the following regular events are also generated as system events:

Warning: Soon the previously listed regular events will be generated only as system events. AT&T Cybersecurity will announce this change in advance. Meanwhile, AT&T Cybersecurity recommends that you disable all orchestration rules in your environment regarding these kinds of regular events and create new orchestration rules based on these system events. See Orchestration Rule for the "Sensor Appears Offline" System Event, Orchestration Rule for the "Sensor Reconnected" System Event,Orchestration Rule for the "Event from Asset Not Received" System Event, and Orchestration Rule for the "Event from AlienApp Not Received" System Event for more information.

Disable Orchestration Rules

AT&T Cybersecurity recommends that you disable all orchestration rules you have created in your environment regarding these events:

  • Sensor appears offline
  • Sensor reconnected
  • Event from asset not received
  • Event from AlienApp not received

To disable an orchestration rule

  1. Go to Settings > Rules.
  2. In the enabled column, click the icon of the rule you want to disable.
  3. Enabled Column on the Orchestration Rules Page

    This turns the icon gray and disables the orchestration rule.