ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Detect incidents not showing up for a long time after initial event

book

Article ID: 172056

calendar_today

Updated On:

Products

CASB Security Standard CASB Security Premium CASB Security Advanced CASB Audit CASB Gateway CASB Gateway Advanced Data Loss Prevention Cloud Package

Issue/Introduction

User would like to know why Detect incidents are not shown immediately after events that should trigger a sequence.

Cause

One requirement of the UBA processing method used by Detect is that the events that are used for analysis be processed in time-order.

Given the varying times at which events arrive for "API", this requires that the UBA wait for a certain time before trying to look at events, to let late-arriving events be considered ... i.e., when the UBA processes a particular “Upload” event that happened at 3:01pm, that event may not arrive into Elastica and therefore the UBA until 3:47pm -- if we were to try process that one event at 3:05pm, it would not be available and CloudSOC (CSOC) would miss it during UBA's analysis. So the UBA chooses some reasonable "window of grace" to allow incoming events to actually arrive before trying to process all events arriving at some particular window. So, there will always be an inherent, longer delay for processing "API" events.

Environment

CloudSOC 2.99.x

Resolution

Allow for sufficient time for the processing method used by Detect to analyze for detect incidents.