Experimental

Overview

Copies tickets from another Logpresso Sonar instance into this one. Use it to collect tickets raised across branch offices, managed customers, or network-separated segments into a single instance.

Tickets are not all that is copied. The detection events behind a ticket and their raw logs come with it, so a copied ticket can be opened and investigated on the evidence that produced it.

Before you start

Install the Experimental app on both instances if you can. It works with the app only on the collecting side, but with it on the remote as well the sync can use a dedicated query command that returns only the tickets that changed, which costs the remote far less. Without it the sync falls back automatically (see "Query mode" below).

Create a dedicated integration account on the remote instance and check the following.

• Multi-factor authentication must be disabled. An extra step in the login flow prevents the connection.
• It needs permission on the ticket repository being copied. Without it neither the tickets nor their evidence are visible.
• Detection rule view permission (stream and batch) is recommended. It is used to make the copied evidence visible - see "Placeholder detection rules" below.

Step 1 - Create a connect profile

Under Settings > Connect profiles, create a profile of type Logpresso Sonar.

Use Test connection before saving to confirm that the login succeeds.

Step 2 - Create a mapping

Under Experimental > Ticket Sync, click Add to open the panel on the right. Work down it in order - each choice fills in the one below.

1. Logpresso Sonar connect profile - the profile from step 1.
2. Remote ticket repository - the repositories on the remote instance. Choosing one loads a preview of its 20 most recent tickets. Use it to confirm you picked the right repository before saving.
3. Local ticket repository - where the copied tickets land in this instance.
4. Polling interval - 5 seconds by default.
5. Sync enabled - save with this on and collection starts immediately.

The connect profile and the remote repository cannot be changed on an existing mapping. A sync that is already running must not be quietly repointed at something else. To change the target, delete the mapping and create a new one.

Reading the list

The last two columns answer different questions: when it last ran, and how far it got. A quiet remote keeps the first moving while the second stands still. If both are stuck in the past, the sync itself is not working - check the indicator.

Hovering a repository name shows its GUID as a tooltip, and the button beside it copies the GUID to the clipboard.

Status indicator

Same convention as the collector list.

It is clickable only when there is an error. The dialog shows the error category, the detailed message, when it happened, when the sync last succeeded, and the collection point - along with advice for that category. From there you can retry immediately with Sync now or move the collection point with Reset.

Reset collection point

This is the only way to pull in older tickets, and also the way to recover a sync that is stuck. Open it from Reset in the list or from the diagnostics dialog.

Pick a point on the calendar and the next round collects from there, clearing the error and the last-sync record. A point in the future is rejected.

• Any round in flight is stopped. Left running, it would finish against the old point and write it back over the one you just chose.
• Tickets already copied stay, and are not fetched again. A ticket that has not changed is recognised from its summary alone, so re-reading a period costs very little.
• Still, the further back you go the longer the next round takes. Months back means a slow first round, and that mapping's next round does not start until it finishes.

What is copied

Copied

• The ticket - title, content, format, priority, status, attack and incident flags, count, first/last seen and event times, tags, creation and update times
• Status transitions - closing it on the remote closes the copy; reopening reopens it
• Evidence events and raw logs - with no count limit
• The GUID - the copy keeps the same GUID, so both instances name the same ticket identically

Not copied

Placeholder detection rules

Starting a sync creates disabled rules in the detection rule list, named original rule name (connect profile name).

They are placeholders that make the copied evidence visible. When Sonar reads events it also checks whether you may see the detection rule that produced them, and the remote rule number a copied event carries does not exist in this instance - left alone, the evidence would be visible to nobody.

• Always disabled. They detect nothing and their query never runs.
• Filed under the mapping's local ticket repository, so the people who can see the copied ticket are exactly the people who can see its evidence.
• The original detection query is preserved as a comment, so an analyst investigating a copied ticket can read the logic that raised it on the remote.

Query mode

The diagnostics dialog shows one of two values under "Query mode".

Installing the app on the remote moves it back to query on the next round.

Troubleshooting

Start from the error category in the diagnostics dialog.

Tickets arrive but evidence is empty

1. Check the diagnostics dialog for an error first. A failed evidence copy fails the whole round.
2. Check that the integration account has detection rule view permission. Without it the placeholder rules cannot be created properly.
3. Check that disabled rules named original name (profile name) exist in the detection rule list.
4. Check that the events are still within the remote's retention. Events already aged out cannot be fetched.

A particular ticket never arrives

Collection keys on a ticket's update time, not its creation time. A ticket created long ago but updated recently does arrive; one whose update time is earlier than "Last ticket" does not. Reset the collection point to before that ticket's update time if you need it.

Limitations

• The integration account cannot use multi-factor authentication.
• Connecting through an HTTP proxy is not supported. The collecting instance must be able to reach the remote directly.
• Ticket deletion is not synced.
• Deleting a mapping leaves the tickets and events already copied in place.
• The same remote repository cannot be mapped twice - two collectors would write the same tickets.