• SpanVA is not connected to CloudSOC.
• SpanVA disconnected.
• SpanVA says DISCONNECTED with a red dot
• Data source is not processing
• 401 API Error from SpanVA Diagnostics Tab
When a SpanVA is provisioned, a token is assigned to the SysAdmin that provisioned the SpanVA. This user must remain active with SysAdmin privileges for the SpanVA to function.
The SpanVA fails to a Disconnected state if the SpanVA owner/user is removed, deactivated, or loses SysAdmin privileges.
• If the user is deactivated, reactivate the user account.
• If the user loses SysAdmin privileges, promote the user back to SysAdmin.
• If the user is deleted, the token is lost, and a new SysAdmin must be provisioned to the SpanVA (see below).
To transfer ownership of the SpanVA to another CloudSOC administrator:
1. Login to CloudSOC as an SysAdmin .
2. Go to Settings > CloudSOC SpanVA
3. Select your SpanVA from the list and click View Details as illustrated below.
4. Verify the existing SpanVA owner (it it has been removed or deactivated) from CloudSOC > Users.
• As indicated above, if the user exists but lost Sysadmin privileges, you should be able to restore rights to the user and or reactivate the user.
• Alternatively, you can reassign SpanVA ownership to another CloudSOC administrator user by clicking 'change' (image below).
Whether the SpanVA owner user was replaced by another, or user reactivated, or user rights restored as SysAdmin:
• Verify the SpanVA status returns to 'Alive'.
• If it doesn't within the next 15 minute cycle, reboot the SpanVA (image below).
SpanVA GUI (by web browser) > Settings > Reboot