Using the System Action Center

Device Sensor Monitoring rules help you monitor the health of your device sensors, notifying you when they are either offline or haven't sent data within a specified amount of time.

Device Sensor Monitoring rules only work for device sensors. They are not supported for Server Sensors (agents).

You can create the following types of Device Sensor Monitoring rules:

• Device sensor feedback –This rule is triggered when the feedback from a Device Sensor indicates that it has been upgraded. Stellar Cyber checks every five minutes for changes in upgrade feedback.

• Device sensor ingestion change – This rule is triggered when a Device Sensor's daily ingestion deviates more than a specified percentage from its average daily ingestion over the last seven days. Stellar Cyber compares these values once per day at 03:00 AM UTC.

• Device sensor status change – This rule is triggered when a Device Sensor's status is either yellow or red, as defined below. A new notification is generated every five minutes the sensor remains in one of these states. You can investigate further in the Sensor list.

  • Yellow – At least one warning condition is affecting the sensor.

    Click here to see the possible warning conditions:

    • Sensor disk usage exceeds 90%

    • Sensor CPU usage exceeds 99%

    • Sensor feedback contains a config mismatch error message

    • Sensor has not updated its status in at least five minutes

    • Sensor feedback shows a failure to apply a profile with the Tenable Nessus feature enabled to a sensor running version 4.3.3 or lower (Tenable Nessus support was introduced in 4.3.4)

    • Sensor feedback contains at least one warning message

  • Red – At least one danger condition is affecting the sensor.

    Click there to see the possible danger conditions:

    • Sensor has an invalid Engine ID (engid)

    • Sensor has a conflicting Engine ID (engid)

    • Sensor configuration is out of sync (either the ver_sent does not match received ver_ack or one of the two messages is missing)

    • Sensor memory usage exceeds 95%

    • Sensor feedback contains a config failure message

    • Sensor feedback shows at least one failure during the application of a new sensor profile.

      The exception to this is a failure to apply a modular sensor profile with the Tenable Nessus feature enabled to a sensor running 4.3.3 or lower. Those failures are reported as warnings and only display the yellow LED, as described above.

  These first three rules are available as part of an Early Access Program and may not be available in your version of the Stellar Cyber Platform. Contact your account manager to inquire about taking part in an Early Access Program.

• No data from device sensor(s) – This rule is triggered when a sensor has not sent a record with traffic within a specified interval.

• No heartbeat from device sensor(s) – This rule is triggered when Stellar Cyber has not received a heartbeat message from a sensor within a specified interval.

Notice that the No data and No heartbeat rules monitor for different types of inactivity. When a No data from device sensor(s) notification is generated, Stellar Cyber may still have contact with the affected sensor but is not receiving records with traffic. In the case of the No heartbeat from device sensor(s) notification, Stellar Cyber is not receiving heartbeats from affected sensors and has not had contact within the specified monitoring interval.

For all rule types, you can also specify a Mute Interval that specifies a window within which a repeated instance of the same notification will not be generated.

. Use the following procedure to create a Device Sensor Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Device Sensor Monitoring from the dropdown that appears.

   

2. Select the type of rule you want to create. See the start of this section for a description of the rule types.

   The Create Notification wizard starts with the Category set to Device Sensor Monitoring and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Set Advanced options for the rule, as described below:

   • All rules include the Excluded Sensors option, with a dropdown that lets you exclude specified sensors from monitoring. The list includes all sensors available to the tenant selected in the first step of the wizard.

   • Some of the rules include additional options, as summarized in the table below:

   Device Sensor Monitoring Rule Type	Advanced Options	Description	Default Value
   Device sensor ingestion change	Ingestion Change Percent	Specify the percentage differential in daily ingestion (up or down) from the average of the previous seven days at which this rule is triggered.	20%
   No data from device sensor(s)	No Data Threshold	Specify the amount of time that can pass without a device sensor sending a record with traffic before this rule is triggered.	1 hour
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for signs of activity from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no activity has been seen during the monitoring interval.	1 hour
   No heartbeat from device sensor(s)	No Heartbeat Threshold	Specify the amount of time that can pass without a device sensor sending a heartbeat before this rule is triggered.	4 hours
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for heartbeats from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no heartbeats have been seen during the monitoring interval.	24 hours

   The image below shows the Advanced step for a No data from device sensor(s) rule:

   

8. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

   • Set the following options for an Email action in the Notification Type: Email section:

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

9. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

Scheduled Report Monitoring rules are available as part of an Early Access Program and may not be available in your version of the Stellar Cyber Platform. Contact your account manager to inquire about taking part in an Early Access Program.

Scheduled Report Monitoring rules can notify you when a scheduled report has failed, helping you investigate report generation issues in real time. Scheduled Report Monitoring rules check for failed reports every five minutes.

. Use the following procedure to create a Scheduled Report Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Scheduled Report Monitoring | Scheduled report failed from the dropdown that appears.

   

   The Create Notification wizard starts with the Category set to Scheduled Report Monitoring and the Type set to Scheduled report failed.

2. Supply a name for your notification rule in the Name field.

3. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

4. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

5. Click Next.

6. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

   • Set the following options for an Email action in the Notification Type: Email section:

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

7. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

Server Sensor Monitoring rules are available as part of an Early Access Program and may not be available in your version of the Stellar Cyber Platform. Contact your account manager to inquire about taking part in an Early Access Program.

Server Sensor Monitoring rules help you monitor the health of your Server Sensors, notifying you when they are either offline or haven't sent data within a specified amount of time.

Server Sensor Monitoring rules only work for server sensors. They are not supported for Device Sensors (dedicated sensors).

You can create the following types of Server Sensor Monitoring rules:

• No data from server sensor(s) – This rule is triggered when a server sensor has not sent a record with traffic within a specified interval.

• No heartbeat from server sensor(s) – This rule is triggered when Stellar Cyber has not received a heartbeat message from a server sensor within a specified interval.

  Notice that these rules are monitoring for different types of inactivity. When a No data from server sensor(s) notification is generated, Stellar Cyber may still have contact with the affected Server Sensor but is not receiving records with traffic. In the case of the No heartbeat from server sensor(s) notification, Stellar Cyber is not receiving heartbeats from affected Server Sensors and has not had contact within the specified monitoring interval.

  For both the No data and No heartbeat rules, you can also specify a Mute Interval that specifies a window within which a repeated instance of the same notification will not be generated.

• Server sensor status change – This rule is triggered when a Server Sensor's status is either yellow or red, as defined below. A new notification is generated every five minutes the sensor remains in one of these states. You can investigate further in the Sensor list.

  • Yellow – At least one warning condition is affecting the sensor.

    Click here to see the possible warning conditions:

    • Sensor disk usage exceeds 90%

    • Sensor CPU usage exceeds 99%

    • Sensor feedback contains a config mismatch error message

    • Sensor has not updated its status in at least five minutes

    • Sensor feedback shows a failure to apply a profile with the Tenable Nessus feature enabled to a sensor running version 4.3.3 or lower (Tenable Nessus support was introduced in 4.3.4)

    • Sensor feedback contains at least one warning message

  • Red – At least one danger condition is affecting the sensor.

    Click there to see the possible danger conditions:

    • Sensor has an invalid Engine ID (engid)

    • Sensor has a conflicting Engine ID (engid)

    • Sensor configuration is out of sync (either the ver_sent does not match received ver_ack or one of the two messages is missing)

    • Sensor memory usage exceeds 95%

    • Sensor feedback contains a config failure message

    • Sensor feedback shows at least one failure during the application of a new sensor profile.

      The exception to this is a failure to apply a modular sensor profile with the Tenable Nessus feature enabled to a sensor running 4.3.3 or lower. Those failures are reported as warnings and only display the yellow LED, as described above.

Use the following procedure to create a Server Sensor Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Server Sensor Monitoring from the dropdown that appears.

   

2. Select the type of rule you want to create. See the start of this section for a description of the rule types.

   The Create Notification wizard starts with the Category set to Server Sensor Monitoring and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Set Advanced options for the rule, as described below:

   Set Advanced options for the rule, as described below:

   • All rules include the Excluded Sensors option, with a dropdown that lets you exclude specified sensors from monitoring. The list includes all sensors available to the tenant selected in the first step of the wizard.

   • Some of the rules include additional options, as summarized in the table below:

   Server Sensor Monitoring Rule Type	Advanced Options	Description	Default Value
   No data from server sensor(s)	No Data Threshold	Specify the amount of time that can pass without a server sensor sending a record with traffic before this rule is triggered.	1 hour
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for signs of activity from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no activity has been seen during the monitoring interval.	1 hour
   No heartbeat from server sensor(s)	No Heartbeat Threshold	Specify the amount of time that can pass without a server sensor sending a heartbeat before this rule is triggered.	4 hours
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for heartbeats from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no heartbeats have been seen during the monitoring interval.	24 hours

   The image below shows the Advanced step for a No data from server sensor(s) rule:

   

8. Use the Suppression step to set up a schedule of times during which notifications from the rule will not be displayed in the Notification Center or sent to configured recipients. This can be handy for suppressing notifications from sensors that you know are normally not seeing any data during specific hours.

   The times you configure for the Suppression schedule are specified in browser time.

   1. Use the Mute Schedule checkbox to enable or disable suppression for the rule. When Mute Schedule is checked, you can set up a schedule as follows:

   2. Select a time zone for the schedule from the dropdown. By default, the time zone is set to your browser's time zone.

   3. Use the Start Day/Time and End Day/Time fields to specify a window of time during which notifications from the rule are not sent.

   4. Use the + Row button to add an additional row to the schedule. Each row creates a new window of time during which notifications from the rule are not sent.

   The figure below shows a sample Suppression schedule configured to exclude notifications during weekends and late evenings on Monday nights to Tuesday mornings:

   

9. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

   • Set the following options for an Email action in the Notification Type: Email section:

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

10. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

    The rule appears in the System Action Center's list and is automatically Enabled.

User Modification rules are available as part of an Early Access Program and may not be available in your version of the Stellar Cyber Platform. Contact your account manager to inquire about taking part in an Early Access Program.

User Modification rules help you monitor a wide variety of changes and events related to user accounts, giving you a powerful audit trail for identity management.

You can create the following types of User Modification rules:

• Account lockout triggered – This rule is triggered when a user's account is locked out due to excessive failed login attempts.

• Account password change – This rule is triggered when an account's password has been changed.

• New RBAC profile created – This rule is triggered when a new RBAC profile is created.

• New user created – This rule is triggered when a new user account is created.

• RBAC profile deleted – This rule is triggered when an RBAC profile is deleted.

• User RBAC privilege escalation – This rule is triggered when the a user's RBAC profile is changed to one with increased capabilities in the platform (for example, from User to Platform Admin).

• User deleted – This rule is triggered when a user account is deleted.

• User has disabled 2FA – This rule is triggered when two-factor authentication is disabled for a user account.

For all User Modification rules, new notifications are sent every five minutes.

. Use the following procedure to create a User Modifications rule:

1. Click the Create button at the top of the System Action Center and select User Modifications from the dropdown that appears.

2. Select the type of rule you want to create. See the start of this section for a description of the available rule types.

   The Create Notification wizard starts with the Category set to User Modifications and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

   • Set the following options for an Email action in the Notification Type: Email section:

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The system only lets you add a Slack action if you have already added a publicly accessible domain in the System | Settings page.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

8. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.