Missing client event log entries in Secure Endpoint

[sesec030]

Hello,

a few days ago, we noticed that the event logs of the individual clients in the Secure Endpoint Dashboard of one of our larger customers only contain very few entries. Normally we see several dozen to 100 or even more entries there, but now in many cases there are only a single-digit number.

This is the case for the majority of the more than 1000 clients. These are not new devices, most of them have been equipped with Secure Endpoint for several years.

Does anyone here know about this phenomenon and what the cause might be? Does this possibly occur after a connector update?

Thank you for your feedback.

[Roman Valenta]

Without further details or examples its really hard to say what you see or what you missing that was normally there. Not sure where you looking in the console.

Are you taking about Events page? If so make sure there is no filters selected and you are viewing correct time range

If you talking about the actual Dashboard heat map  the same apply here as well make sure you looking correct time and no filters are applied.

Also remember that retention policy is 30 days so everything older than 30 days will be removed. In other words lets say your compromise was 24% yesterday and today when you look you see only 5% , that means 19% of those compromise events yesterday were probably older than 30 days and got removed. This also apply to any other events under Events page

If you still think that there is issue please open TAC case and we will be more than happy to take a look

[sesec030]

Hello Roman, thank you for your reply. Here is an example. Time range is 30 days, no filters are applied. This client is active almost every day. It looks like this or very similar on most of the clients. Any idea?

Thank you.

[Roman Valenta]

Well that look definitely not right even in my lab I have more events per computer than what you showing. This could be isolated to your org and will have to be check internally. Can you please open a TAC case so we can address that? 

[sesec030]

Ok, i will open a TAC for this. Thank you again.