Huntress Managed SIEM log sources have several potential statuses that help users and administrators understand their state. While each status in the Source Management page has a hover over tooltip, this knowledge base article will detail each possible status.
Log Source Statuses
Free
Free log sources are sources included with the Huntress Platform and other Huntress products like ITDR and Defender for Endpoint. These sources do not count toward your purchased log source entitlements and can be used like any other log source. There are no detections built on these logs.
Active
Active log sources are sources that count toward your purchased log source entitlements and have sent logs in the current billing cycle. These log sources will be used by the Huntress SOC during investigations and detection signals are created for security relevant log messages.
Inactive
Inactive log sources are sources that have not been disabled but the SIEM has not received any logs from in the past 30 days. Since these log sources have not contributed any logs in the past 30 days, they will not contribute to the next billing cycles log source entitlement count if they continue to be inactive. If a log source is inactive and not sending logs, no detections will be created without logs to generate them. Older logs collected within a reasonable time period will still be available for the SOC to use when performing investigations.
Disconnected
Disconnected log sources are sources that have been disabled to prevent collection and will be removed from the purchased log source entitlement count in the next billing cycle. If a source is disconnected in a billing period and has collected data during that billing period, it will count toward your purchased entitlement usage, but will not count toward the next billing cycle usage. If a log source is disconnected and not sending logs, no detections will be created without logs to generate them. Older logs collected within a reasonable time period will still be available for the SOC to use when performing investigations.
Connecting
Connecting log sources are sources that have been configured via HEC or API and are currently awaiting the initial logs from the source. A log source will only be in the "Connecting" state until the first log is received, after which it will be in the Active state unless no additional logs are sent, at which point it will transition to the Inactive state after 30 days.