SOC Live View

The SOC live view is a screen for a control room or service desk that stays open all day. It shows the alarms that are active right now — a camera that went offline, an uplink without a link, a device refused by 802.1x — with how long each one has been standing, a live feed of what happens on the network, and a sound when a new alarm comes in.

It covers the network and access to it: switches, ports, devices and authentication. It does not monitor the inside of computers, such as processor load or disk space.

Opening the live view

Click SOC at the top of the screen, next to the clock. The live view fills the screen with its own header:

• Live shows that this screen is receiving updates; it turns orange and then red when the appliance cannot be reached.
• Collector shows that the appliance is checking the network every minute; Collector stalled means the checks have stopped and what you see is no longer current.
• Enable sound, Full screen and the colour theme.
• History and, with the right role, Settings (the same page as System > SOC).

The page updates itself every ten seconds. An account that may only use the SOC live view lands on it straight after logging in (see A screen in the control room).

Alarms

Active alarms are sorted by severity, then the ones nobody has acknowledged yet, then the oldest. Each alarm shows its severity in words, what is wrong, how long it has been going on, and where: the switch and port, the location and rack, the patch point, the device group. Click an alarm for all details and its history.

Switches and devices are checked every five minutes, and a single lost ping is retried before anything is reported. A switch that sends its syslog to the appliance (see the switch configuration guides) is read again as soon as it logs something about a port, so an uplink or port alarm appears within about two minutes. The log line itself never raises an alarm — syslog can be forged — the fresh reading of the switch does. Refused authentications and honeypot probes appear within a minute, a blocked login straight away.

One cause, one alarm. While a switch is down or cannot be read, the ports and devices behind it raise no alarms of their own: the switch alarm covers them, and nothing is reported as resolved just because it could not be checked. The same applies to a virtual device whose host is offline.

Offline alarm per device group

Which devices raise an alarm when they go offline is set on the device group: No alarm, Warning or Critical under Offline alarm. Set cameras to Critical, for example, and leave workstations that are switched off at night at No alarm. System > SOC lists every group.

Acknowledging, muting and closing

Acknowledging an alarm is not the same as resolving it — the same model Zabbix uses for problems:

• Acknowledge says "seen, someone is on it". The sound stops and the alarm shows who acknowledged it and when, but it stays in the active list until its cause is gone. You can acknowledge an alarm at any moment, also while the problem is still going on.
• Resolved happens by itself: once the camera answers again or the uplink has its link back, the alarm moves to Recently resolved (fifteen minutes by default) and then to the history.
• Mute silences and dims an alarm for 1 hour, 8 hours, 24 hours or until it is resolved — for a known problem that is waiting for a part, say.
• Close is for alarms that have nothing to recover from: Access rejected, Honeypot triggered, Login blocked and IP address conflict. Once dealt with, close them; a new occurrence opens a new alarm. An alarm that clears by itself cannot be closed by hand.

Every action can carry a comment, and every action is kept in the alarm's history with who did it and when — the trail you see under History in the alarm window. Add comment records a note without changing the alarm, also on an alarm that is already resolved. Each action is also written to the audit log.

An Access rejected alarm clears by itself when the same device is accepted afterwards. An IP address conflict clears by itself when it has not been seen for fifteen minutes.

A Login blocked alarm names the address, the device it belongs to if that is registered, and the accounts the attempts were against — never a user name that does not exist, since that is often a password typed into the wrong field. It does not clear when the block runs out: whether someone forgot a password or something is guessing them is for an operator to judge. Another block of the same address counts on the open alarm.

Live feed

The right-hand column shows what happens on the network as it happens: access granted and refused, switches and monitored devices going off- and online, IP address changes, service ports opened and closed, the switches' own log lines about their ports, blocked logins, and — with the Inspection option — marked ports losing or regaining their link and SSL findings. Access granted only ever appears here; it is never an alarm.

The feed reports changes, not repetitions: a device that keeps re-authenticating appears when its result changes, not every time. Devices in a group without an offline alarm stay out of the feed, so workstations going home at the end of the day do not fill it.

Sound

The sounds are set for every screen at once, under System > SOC: a tone for Critical and one for Warning (Beep, Chime, Alarm or No sound), and how often it repeats while an alarm is neither acknowledged nor muted. A new alarm always sounds straight away.

A browser only plays sound after the page has been clicked once. Click Enable sound on the live view; afterwards the same button turns the sound off and on for that screen only. A short beep each time the sound is switched on confirms that it works. A screen without anyone at it can start its browser with sound allowed instead, for example Chrome or Edge with:

--autoplay-policy=no-user-gesture-required --kiosk https://<appliance>/soc

History and retention

History, at the top of the live view, lists every alarm, open and resolved, with filters for type, severity, status, date and text — a device name, switch, port or MAC address. Click an alarm for its details and the comments made on it.

Resolved and closed alarms, their acknowledgements and comments, and the live feed are kept for 30 days by default; System > SOC changes this from 1 to 365 days. Open alarms are kept for as long as they are open.

Settings

System > SOC holds:

• Alarm types — the severity of each type, or No alarm to switch a type off
• Sound — the tones and how often they repeat, with a Test button
• History and display — how many days to keep, and how long resolved alarms stay on the live view
• Offline alarm per device group — an overview with a link to each group

A screen in the control room

• Create a user for each screen with the role soc-view — plus soc-acknowledge if the operators should acknowledge from it — and without dashboard. That user lands on the live view after logging in and never sees the menu.
• Give every screen its own account: logging in with the same account somewhere else logs the screen out.
• The screen stays logged in for as long as the page is open. If the account is disabled or loses its role, the screen says so within ten seconds.
• Collector stalled in red means the appliance stopped checking the network; contact your administrator.

License and roles

The SOC live view is the SOC license option (included in a Full license). The roles are:

• soc-view — open the live view and the history
• soc-acknowledge — acknowledge, comment on, mute and close alarms
• soc-settings — change the SOC settings and the offline alarm of device groups

Administrators have all three.