This topic describes how to view the deployment stats for an ESA service. This procedure is useful when you are attempting to determine the effectiveness of a rule or troubleshoot a deployment.
View ESA Stats
- In the Security Analytics menu, select Alerts > Configure > Services.
- From the ESA Services list on the left, select a service.
The deployment stats for the selected service are displayed.
- Review the following sections of ESA stats.
For a complete description of each statistic in each section, see Services Tab.
- Engine Stats
- Rule Stats
- Alert Stats
- In the Deployed Rule Stats, review details about the rules deployed on the ESA.
For a complete description of each column in each section, see Services Tab.
- If the rule is enabled or disabled
- What the rule name is
- If the rule is running in Trial Rule mode
- Last detected
- Events matched
- To get a snapshot of the rule memory, click Health & Wellness.
Enable or Disable Rules
- In the Deployed Rule Stats panel, select a rule from the grid.
- Click to enable the rule, or click to disable the rule.
The Services tab is refreshed to show the changes, which take effect immediately.
Refresh the Statistics
The Services tab does not update statistics automatically unless you enable or disable a rule. To ensure you view current statistics: