Non-Reporting Log Source Escalations

Huntress Managed SIEM provides the option to generate an escalation when a log source stops reporting.

Enabling Non-Reporting Log Source Escalations

Non-Reporting Log Source Escalations can be enabled by account administrators. 

To do so, follow these steps:

1. Navigate to SIEM -> Source Management via the navigation sidebar.
2. Click the Settings tab.
3. To enable Non-Reporting Escalations, toggle the Escalations button to On.
4. Configure the dropdown time to determine how long a log source should be offline before an escalation is triggered.

There are two conditions for an escalation to trigger.

1. The log source must have reported in consistently, at least once an hour, for 7 consecutive days (Mon-Sun) before an escalation will trigger. Once a log source has gone offline and triggered an escalation, then come back online, it will take 7 days of consecutive activity before escalations will trigger again.
2. The log source must stop reporting for the configured time in the Escalations setting. The available period options are 1, 4, or 8 hours. Once a log source has stopped reporting for that configured time, an escalation will be generated.

Auto-Closing Escalations

If the log source that triggered an escalation starts reporting in again, the escalation will automatically close, and no additional actions are needed.