Operational Status Settings

The Operational Status Settings page is where you enable and configure scheduled checks that test the health of your Director, integrations, and Actors. You have the flexibility to enable or disable any or all tests available so you can continuously monitor Security Validation and quickly identify which areas need attention. All tests are disabled by default. After tests are enabled and have the time to execute, you can view their results in the Operational Status page.

Not all tests are available on both MSV and MA-SV. If a test is only available on either MSV or MA-SV, it is called out for you.

Operational Status Settings when all integration tests are enabled

Configure Tests For Director, Actors, and Integrations

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.
  3. Select On for the following:

    • Enable Director Tests: Enables tests for the Director (MSV only)

    • Enable Integration Tests: Enables tests for the integrations
    • Enable Actor Tests: Enables tests for the Actors
  4. Click Update Operational Readiness Settings.

Configure Scheduled Checks for The Director

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.

  3. Navigate to Scheduled Checks - Director.

  4. In Director Polling Interval, select an interval (in minutes or hours, based on the interval format you select below) for running tests. The default interval for Director tests is 1 hour.

  5. In Director Polling Interval Format, select one of the following options:

    • Minute(S)

    • Hour(S)

  6. In Notification Generation Interval for Director, enter the interval for when failure notifications will be generated for the Director.

    The notification will be generated based on the value you input. For example, if you set the interval value to 3 and configure your notification to generate on failures only, after the test has run 3 times and each time has failed, the notification will be generated.

  7. You can leave tests enabled or choose to disable any of the following:
    • Verify Services Running Test: Checks whether Director services are running.
    • Email Test: Checks whether email settings are configured correctly.
    • DNS Server(s) Test: Checks whether DNS servers are accessible. (MSV only)
    • NTP Server(s) Test: Checks whether NTP servers are accessible. (MSV only)
  8. Click Update Operational Readiness Settings.

Configure Scheduled Checks for Integrations

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.
  3. Navigate to Scheduled Checks - Integrations.
  4. In Integration Polling Interval, select an interval (in minutes or hours, based on the interval format you select below) for running tests. The default interval for Integration tests is 1 hour.

  5. In Integration Polling Interval Format, select one of the following options:

    • Minute(s)

    • Hour(s)

  6. In Notification Generation Interval for Integrations, enter the interval for when failure notifications will be generated for the integrations.

    The notification will be generated based on the value you input. For example, if you set the interval value to 3 and configure your notification to generate on failures only, after the test has run 3 times and each time has failed, the notification will be generated.

  7. You can leave tests enabled or choose to disable any of the following:

    • Verify Integrations Exist and Enabled: Checks whether there is at least one integration in the Director and whether integrations are configured correctly.

    • Validate Job Blocked Results Have Events: Checks whether Jobs with blocked Actions generated integration events as expected.

    • Director Integration Test: Runs the Test Query defined for each local integration and verifies connectivity, authentication, and ability to run queries.

    • Remote Integration Test: Runs the Test Query defined for each remote integration and verifies connectivity, authentication, and ability to run queries.

  8. Click Update Operational Readiness Settings.

Configure Scheduled Checks for Actors

Before any Actor tests begin, a Communications Test is first run to verify the Actor and Director can communicate. If the Communications Test fails, no other Actor tests will run. Communications Test results appear in the Operational Status page.

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.
  3. Navigate to Scheduled Checks - Actors.
  4. In Actor Polling Interval, select an interval (in minutes or hours, based on the interval format you select below) for running tests. The default interval for Actor tests is 1 hour.

  5. In Actor Polling Interval Format, select one of the following options:

    • Minute(s)

    • Hour(s)

  6. In Notification Generation Interval for Actors, enter the interval for when failure notifications will be generated for the Actors.

    The notification will be generated based on the value you input. For example, if you set the interval value to 3 and configure your notification to generate on failures only, after the test has run 3 times and each time has failed, the notification will be generated.

The Communications Test is always enabled.

  1. You can leave tests enabled or choose to disable any of the following:
    • Validate Actor Versions Test: Verifies all Actors are running the current version.
    • DNS Resolution Test: Checks whether Actor has a DNS record. If this test is enabled, you need to enter the domain name to use.
      • Domain Name for DNS Test: Enter the domain name.
    • NTP Server(s) Test: Checks whether NTP servers are accessible.
    • Actor Time Skew Test: Checks whether the Actor and Director are using the same time.
    • Verify Services Running Test: Checks whether Actor services are running.
    • Email Test: Uses Actors' Email Profiles to check the connectivity, authentication, and ability to read the inbox. Email tests do not attempt to send any emails.
    • Validate Protected Actor Snapshot Aging Test: Checks the date of the latest protected Actor snapshot. If this test is enabled, you need to specify a snapshot age (days). The test fails if the snapshot is older than the age specified. By default, the test checks whether protected Actor snapshots are older than 10 days.
      • Protected Actor Snapshot Outdated (days): Select number of days.
  2. Click Update Operational Readiness Settings.
  • For more detailed information about these tests, see Operational Status: Actor Tests.
  • When you visit the Operational Status Settings page after your tests have run, you will see timestamps for the latest checks run.

Operational Status Notifications

Notifications are sent out when a test is run for the first time or when a test's result changes (from passed to failed or vice versa). By default, the platform notifies you by adding a red dot to the Environment menu. When you expand the menu, you see that Operational Status displays the number of new test results. The notification clears after you view the latest test results in the Operational Status page.

Operational Alert Badge in App for Failures & Passes

Configure Alert Badges in App

To configure the conditions for when the operational alert badges show in the drop-down list in the Environment navigation menu:

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.

  3. In Show Operational Alert Badges in App for, select one of the following options:

    • Default - Failures & Passes

    • Failures

    • Passes

  4. Click Update Operational Readiness Settings.

You can also enable email, syslog, and web hook notifications to communicate changes to the platform's operational status.

Add Custom Operational Status Notifications

  1. Go to Settings > Director Settings. The Systems Settings page opens.

  2. Select Operational Status.
  3. In Operational Status - Notification Settings, click Add Notification.
  4. Add the optional Notification Details:
    1. Enter a Name and Description for the notification.
    2. Select Failure only if you only want to be notified when a failure occurs instead of each time the status changes.
  5. Select a Notification Type.
    • If you select Email:
      1. Specify who will receive email notifications by checking the box next to the user's email address.
      2. Specify a User Group by checking the box next the user group. You can send email notifications to specific addresses, system users, and user groups.
    • If you select Syslog:
      1. Specify which syslog server to send notifications to.
      2. Enter the syslog port. This defaults to port 514.
      3. Select whether to use TCP or UDP.
    • If you select Web Hook:
      1. Enter the URL where the notification will be posted.
      2. Choose the Web Hook Message Type (Basic JSON or Microsoft Teams).
        The Basic message type is a standard JSON string. The Microsoft Teams option is like Basic, but adds 'title' and 'text' fields where the title is always 'Mandiant Security Validation Notification' and text is a fully-escaped JSON string.

        If you want to verify the Web Hook is configured correctly, click Send Sample.

  6. Click Submit.

Operational Status - Notification Settings with an email notification set up for system admins

© Copyright Mandiant. All rights reserved
  • First Published: June 5, 2022
  • Last updated: September 21, 2023
In This Article
Related Articles
Copyright © 2020 – 2021 Your Company, LLC. All rights reserved.