Hey everybody,
I’m currently trying to work out the best way to create alerting for what I call “non-events”, as in transfers for which an expected event does not occur. For example, we may use Gateway (XFB) to reach out to a remote site and do a directory listing every 15 minutes for a file that we expect at the top of every hour. XFB isn’t smart enough out of the box to know not to execute a scheduled event when the first instance of that event was successful, so we’re stuck executing every 15 minutes.
In Sentinel, I could create a correlation rule that says if the directory listing returns a 0 byte file (meaning no files listed), to create an alert. Unfortunately we may get the file on the 2nd instance of the scheduled pull, in which case the alert would be valid. Likewise, were I to schedule an alert for the event that the directory listing on the 2nd instance of the scheduled pull was empty, we don’t necessarily want to create an alert because the 1st instance may have retrieved the file.
Has anybody found a useful way to handle this in Sentinel/Gateway?
Thanks all,
Tony Lloyd
continue reading.....
