 Role Availability
|
 Read-Only
|
Investigator |
 Analyst
|
Manager
|
USM Anywhere provides a centralized view of regular events and system events Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall..
From now on, and during a grace period, the following regular events are also generated as system events:
- Sensor appears offline (see Sensor Disconnected from the USM Anywhere Service for more information)
- Sensor reconnected (see Sensor Disconnected from the USM Anywhere Service for more information)
- Event from asset not received (see Events Created When an Asset Stops Sending Data for more information)
- Event from AlienApp not received (see Events Created When AlienApps Stop Receiving Data for more information)
Warning: Soon the previously listed regular events will be generated only as system events. AT&T Cybersecurity will announce this change in advance. Meanwhile, AT&T Cybersecurity recommends that you disable all orchestration rules in your environment regarding these kinds of regular events and create new orchestration rules based on these system events. See Orchestration Rule for the "Sensor Appears Offline" System Event, Orchestration Rule for the "Sensor Reconnected" System Event,Orchestration Rule for the "Event from Asset Not Received" System Event, and Orchestration Rule for the "Event from AlienApp Not Received" System Event for more information.
Disable Orchestration Rules
AT&T Cybersecurity recommends that you disable all orchestration rules you have created in your environment regarding these events:
- Sensor appears offline
- Sensor reconnected
- Event from asset not received
- Event from AlienApp not received
To disable an orchestration rule
- Go to Settings > Rules.
- In the enabled column, click the
icon of the rule you want to disable.
This turns the 
icon gray and disables the orchestration rule.
Feedback