Sensor groups tab

About sensor groups

A sensor group is a correlation domain; a mechanism to correlate data from multiple sensors under a single identifying Sensor. All incidents and campaigns belong to the sensor group. The sensor group correlates events from its member sensors into incidents and campaigns. All events are detected by individual sensors and attributed to them. Incidents and campaigns are attributed to the sensor group. Events from sensors that are not part of the sensor group are not combined or correlated (however, they are combined within the sensor, allowing campaigns to be derived).

If a sensor is not part of a sensor group or if an incident was detected before the sensor was configured to be a member of a sensor group, that incident will be attributed to the individual sensor.

Some guidelines and features of sensor groups:

• A group will only start aggregating new incidents after it is created. This means there won't immediately be any incidents or events for a new group.

• A group is identified by a sensor. This sensor is the group identifier and is always listed first in the listing of sensors the group contains. It cannot be removed.

• The group identifier should be an existing sensor, associated with an actual appliance. Select Existing sensor key when you create a group. See Sensor group notifications for more information about how notifications are processed for sensor groups.

• A group name can only be changed by changing the name of its identifying sensor. Navigate to Sensors tab and modify the sensor name in the Name column.

Sensor groups list

After you create a group, you can then select it with the license and sensor selection in the portal settings widget. Selecting a group will return data associated with all the sensors in the group.

Click the icon to scroll down to the Add group section.

The quick search field above the list provides fast, as-you-type search. It filters the rows in the list, displaying only those rows that have text, in any field, that matches the query string.

Click to collapse all the sensor group details. Click to expand all the sensor group details.

The columns to be displayed in the list can be customized by clicking the icon.

Each row is a summary of a sensor group. Click the icon (or anywhere on an entry row) to access the sensor group details.

The list is sorted by name and includes the following fields:

License key

The unique identifier for the sensor group. It is the license key with the sensor key concatenated to it, for example, ABCDEFGHIJ0123456789:sensor-1

Click the icon in the list header to sort the list by license key.

Name

The name assigned to the sensor group.

Member count

A count of the number sensors that belong to the sensor group.

Click the icon in the list header to sort the list by member count.

Controls

Click the icon to delete the sensor group. Click the Confirm group removal button or Cancel.

Sensor group details

Expanding the Sensor groups list allows you to view and modify the sensor group components.

Create a new sensor group

A sensor key is required to identify the new group. This key can be associated with a physical Sensor. It is primarily used as an identifier for the sensor group. You can use a virtual sensor.

To create a new sensor group in the Add group section, perform the following steps:

1. Select the Group identifier source. Your choice is New sensor key or Existing sensor key. The recommendation is that you use an existing sensor key.

2. Select a License key from the pull-down menu. For example, ABCDEFGHIJ0123456789.

3. Select a Sensor from the pull-down menu. The License key, Sensor key, and Sensor name are displayed below the menus.

Click Create group from existing sensor to save the sensor group.