Alerting: View Stats for ESA Service

Document created by RSA Information Design and Development on Mar 23, 2017Last modified by RSA Information Design and Development on Apr 26, 2017
Version 4Show Document
  • View in full screen mode
  

This topic describes how to view the deployment stats for an ESA service. This procedure is useful when you are attempting to determine the effectiveness of a rule or troubleshoot a deployment. 

Procedures

View ESA Stats

  1. In the Security Analytics menu, select Alerts > Configure > Services.
  2. From the ESA Services list on the left, select a service.
    The deployment stats for the selected service are displayed.
    SvcsTb1Esper.png
  1. Review the following sections of ESA stats.
    For a complete description of each statistic in each section, see Services Tab.
  • Engine Stats
  • Rule Stats
  • Alert Stats
  1. In the Deployed Rule Stats, review details about the rules deployed on the ESA.
    For a complete description of each column in each section, see Services Tab.
  • If the rule is enabled or disabled
  • What the rule name is
  • If the rule is running in Trial Rule mode
  • Last detected
  • Events matched
  1. To get a snapshot of the rule memory, click Health & Wellness.

Enable or Disable Rules

  1. In the Deployed Rule Stats panel, select a rule from the grid.
  2. Click EnableRuleBtn.PNG to enable the rule, or click Disable_Button.png to disable the rule.

    The Services tab is refreshed to show the changes, which take effect immediately.

Refresh the Statistics

The Services tab does not update statistics automatically unless you enable or disable a rule. To ensure you view current statistics:

  1. Click Refresh icon in the upper right corner to refresh the information.
  2. View the updated information. 
You are here
Table of Contents > View ESA Stats and Alerts > View Stats for ESA Service

Attachments

    Outcomes