Skip to main content
Go to Red Canary Documentation
Red Canary Support

Review Subdomain to Verify Overall Integration Health

  • Updated .

Issue

User wants to perform a general health check on their Red Canary Portal to validate whether integrations are working properly.

Environment

Red Canary Portal

Resolution

To verify the health of your integrations, follow the steps below in your subdomain.

  1. From the Red Canary Portal, navigate to the Integrations page or click here
  2. Right-click an integration Display Name you want to investigate and select Copy (it helps to have the name in your clipboard for larger subdomains with multiple integrations)
  3. Navigate to the Status Check page or click here
  4. Click the Filter button Filter_Button.png and paste or search the integration name in the Integration field
    • If the filter shows No results found, skip to Step 7 as there are no checks tied to this integration
  5. If the Status field is populated, remove this filter
  6. Click Apply Filters and review all status checks associated with the integration to determine health
    • Failing status checks should be reviewed for errors and those errors searched in our knowledge base for any known resolutions.  Open a ticket with Red Canary Support if the issue persists.
  7. Navigate to Reports, then select the Integrations by the Numbers report or click here
  8. Set the report time range to Trailing 30 days, or select a shorter custom range, like the last 3 days
  9. Click Select an integration and paste or search the integration name
  10. Review Data Collection for volume of data ingested over the report time range to validate data flow
    • If an integration shows 0 data collected, broaden your report time range by a year or more to determine whether Red Canary has ever ingested data for that integration
  11. Repeat Steps 1-10 for each integration to be reviewed

General Review Tips

  • Platforms outside of this list will typically not have any associated integration status checks
  • Some platforms will have a separate integration for tracking telemetry and alerts, like SentinelOne CloudFunnel (telemetry) and SentinelOne Singularity (alerts)
  • For alert sources, telemetry volume reported on the Integration page only represents the volume of raw data associated with published external alerts.  Data that is filtered out, like uninteresting PAN-OS syslog messages, will not be included in these counts
  • Microsoft Graph v2 integration is an aggregate-only parent alert source that does not directly ingest any data.  Refer to the individual Graph data sources to validate alert ingest
  • Some Microsoft Graph v2 data sources may not apply to your organization.  For example, Microsoft Defender for Identity v2 only ingests alerts from on-prem domain controllers running Defender for Identity sensors.  Uncheck any data sources under the aggregate integration that are not in use
  • Cloud platforms, like AWS and Azure, will have child integrations and associated status checks for each account or subscription, which can be overwhelming to review in larger organizations.  Instead, select a sample size of two or three accounts and run queries on the Status Check page for cloud_account:{accountID} to identify any failed status checks
  • With low-volume sources, like an AWS account that sees infrequent use, failing status checks for telemetry or alert ingest are to be expected

Cause

The Status Check page is designed to bring integration issues to an organization's attention.  Meanwhile, the Integrations by the Numbers report tracks a running count of data volume for a given integration in near-realtime.  These two features can generally be used to confirm whether an integration is receiving data and configured correctly.

Tags

Red Canary health check, subdomain review, health review, organizational health, health status, status check review, need integrations reviewed, integrations configured correctly, need Red Canary review, check integrations, is integration working properly, verify integration working properly, confirm integration working properly, health sync, status review, check portal health, check subdomain health, is everything working, full portal review, is my integration working, full subdomain status review, verify integrations, validate subdomain, validate integrations, verify subdomain, check if integration is working