Events Created When an Asset Stops Sending Data

Overview
USM Anywhere Architecture
USM Anywhere Data Security
USM Anywhere Log Data Enhancement
USM Anywhere Quick Start Guides
USM Anywhere Deployment Guide
USM Anywhere User Guides
- Overview
- Getting Started with USM Anywhere
- USM Anywhere Best Practices
- USM Anywhere Dashboards
- Asset Management
  - Overview
  - Asset Administration in USM Anywhere
  - Asset Groups Administration
  - Performing Vulnerability Scans
  - Viewing Vulnerabilities Scan Results
  - Searching Vulnerabilities
  - Viewing Vulnerabilities Details
  - Available Remediation Patches for Vulnerabilities
  - Labeling the Vulnerabilities
  - Create a Vulnerabilities Report
  - USM Anywhere Scans Best Practices
- Alarms Management
- System Events Management
- Console User Events on USM Anywhere
- Configuration Issues Management
- User Behaviour Analytics
- Events Management
- USM Anywhere Scheduler
- Rules Management
- Vulnerability Assessment
- Open Threat Exchange® and USM Anywhere
- USM Anywhere Sensor Management
- The AWS Cloud Connector in USM Anywhere
- Subscription Management
- USM Anywhere Reports
- Machine Learning
- USM Anywhere User Management
- Using USM Anywhere for PCI Compliance
- USM Anywhere Investigations
- System Status within USM Anywhere
USM Anywhere Agents Guide
USM Anywhere BlueApps Guide


Role Availability	Read-Only	Investigator	Analyst	Manager

USM Anywhere gives you the option of configuring a threshold after which asset inactivity is a concern. When your environment is not receiving events from an asset within the configured period of time, USM Anywhere generates monitoring events that display in the Events List View page. Since these events are not tied to any USM Anywhere Sensor that you have deployed, you will see a new sensor with the name of your USM Anywhere subdomain listed for these events. USM Anywhere will generate new monitoring events until the asset starts reporting again. You can see two types of monitoring events:

vent from asset not received: Event details include the asset name, the total disconnected time, and when the last message was received.
Warning: Currently, the Event from asset not received event is generated at the same time as the regular event and system event. Soon, this event will be generated only as a system event. See Regular Events and System Events and Orchestration Rule for the “Event from Asset Not Received” System Event for more information.
Event from asset received: Event details include the asset name
Warning: Monitoring events are generated when your environment is not receiving events from an asset either because the asset is not sending events or because of a filtering rule. If you have a rule that filters events coming from an asset, from the perspective of USM Anywhere that asset is not sending events.

Note: If your sensor is collecting logs using anything other than syslog (like scheduled log scans), your logs may not include enough data to inform these events. To ensure that you are receiving events when your asset stops sending data, ensure that the Reporting Device field is present and populating accurately.

To configure the period of time for a single asset

Go to Environment > Assets.
Next to the asset name whose details you want to review, click the icon.
Select Full Details.
In the upper-left side of the page, set a period of time in the Create Event If Asset Stops Sending Data field by clicking the icon. You can select a predefined value between None, 1 hour, 6, 12, 24, or 72 hours, 1 week, or 2 weeks.

Note: By default, this field is configured to None.

Important: The Create event if asset stops sending data field is based on the Reporting Device Address field, not the Source field. When a device reports information about its state, the Reporting Device Address field will display the same data as the Source or Destination fields. If the device reports information that is different from its state, for example issues in its network, the Reporting Device Address field will display different information from the Source or Destination fields.

Click the icon to set the value.

The events are displayed in the Events List View page. To configure the period of time for multiple assets

Go to Environment > Assets.
Select the checkbox of each asset you want to include.
Select Actions > Edit Fields.
At the bottom of the Configure Assets dialog box, set a period of time in the Create Event If Asset Stops Sending Data field by clicking the icon. You can select a predefined value between None, 1 hour, 6, 12, 24, 72 hours, 1 week, or 2 weeks.
Note: By default, this field is configured to None.

Important: The Create event if asset stops sending data field is based on the Reporting Device Address field, not the Source field. When a device reports information about its state, the Reporting Device Address field will display the same data as the Source or Destination fields. If the device reports information that is different from its state, for example issues in its network, the Reporting Device Address field will display different information from the Source or Destination fields.
Click the icon to set the value.

The events are displayed in the Events List View page. To see events created when an asset stops sending data

Go to Activity > Events.
Locate the Event Name filter, and then select the filter Event from Asset Not Received.
The result displays with the filtered events.
Click the event to see its details.

Events Created When an Asset Is Discovered Managing Asset Fields

USM Anywhere™

USM Central™

Automated Policy Manager

Events Created When an Asset Stops Sending Data