Sources

75 connections across 12 tenants. One has been silent for 14 minutes.

Onboard a tenant
Pipeline From the source to searchable in 1.4 seconds. The raw event is kept at every step. All five stages healthy
  1. Received
    14.4k/s
    from 75 connections
  2. Parsed
    99.97%
    read cleanly by a parser
  3. Normalised
    98.6%
    mapped to an OCSF class
  4. Detections evaluated
    0.4 s
    median wait for rules
  5. Stored
    285 GB
    24 h, hot storage 62%
Parse errors
0.03%
4 events/s, kept for replay
Dropped
0
in the last 24 h
Ingest lag
1.4 s
median, all sources
Coverage Tenant by source

Each cell draws the last hour of events. Lagging means later than that source normally runs. Silent means nothing for 10 minutes from a source that should never stop.

Connection
About to break Still working today
Endpoint agents DPSIEM agent on Windows
On-site collectors
TenantHostVersionLast seen

A collector keeps events on its own disk when the link to DPSIEM drops and sends them once it returns, oldest first. Select a row to see the firewall it carries.

Add a source