Discovery sensors
Every probe in Discovery must have a corresponding sensor to process the data returned.
For example, if incoming data is the result of a WMI probe, then
the WMI sensor is triggered to process the payload.
Note:
If you create a multiprobe, you must create a multisensor to
process the data returned from this probe. For details, see Multiprobes and Multisensors.
Navigate to and edit or create a sensor.
| Field | Description |
|---|---|
| Name | Enter a unique probe name. |
| Reacts to probe | Select the probe whose payload this sensor must process. |
| Sensor Class [sys_class_name] | Select the type of sensor to create:
|
| Description | Enter an optional description of the sensors function. |
| Sensor type [sensor_type] | Specify how the results from the probe are processed.
|
| Active | Select this option to enable or disable the sensor. |
| Script | Enter a script to run when processing the probe. You can use the
g_probe_parameters hashmap in a sensor script to set probe parameters for any
configured, triggered probes. For example, this code sets a
'node_port' parameter to 16001 for all triggered
probes. |
| Responds to probes | Use this related list to specify the simple probe within a multiprobe whose payload this multisensor must process. This list is available for multisensors only. |
| Triggers probes | Use this related list to specify which probes this sensor can start for additional exploration. |
| These fields can be added by configuring the form | |
| Field | Description |
| Agent | Enter the ECC queue type to match this sensor with. |
| Apply Defaults | Select this option to apply default sensor values. |
| Classification type | Select the classification type associated with this sensor. |
| Coalesce | Enter the field to match against when determining whether to coalesce. |
| Condition script | Create a predetermined requirement for this sensor to run. |
| Data option | Select how to treat imported sensor data. Options include:
|
| External names | Enter a name to tag the sensor data. |
Cancel sensor transaction by duration
By default, this rule cancels the sensor transaction if it takes more than 20 minutes to complete.
Before you begin
About this task
If the Discovery sensor transaction takes more than 20 minutes to complete, the
following actions occur:
- The associated ECC Queue input record is set to the error state.
- The Discovery Status Completed Count is updated.
- An error message is logged, for
example:
Sensor error when processing Linux - Storage: Transaction cancelled: maximum execution time exceeded - The remainder of the discovery continues to run.
This behavior is provided by the Discovery Sensors Transaction Quota Rule. This rule is active by default.
You can disable the rule and you can modify the amount of time that has elapsed before the rule takes effect. Accessing this record requires the admin role.