Skip to content
Docs
foxborne.comRequest a pilot

Monitor a deployment

Watch a deployment from signals the console already shows. The status bar, the sidebar counts, sources, collectors, runs, Hosting and the audit log each point to where to act.

How-toEvery deploymentAdminMarkdown
On this page5

Foxborne reports the state of a deployment in the console itself. Start at the status bar, follow the sidebar counts, then read Sources, Runs, Hosting and the audit log. The table at the end of this page maps each signal to what to do.

Before you start#

  • You need the Admin role for Sources, Vehicle collectors and Hosting.
  • Admins and auditors can read the audit log.

Check a deployment#

  1. Read the status bar

    The status bar runs along the bottom of every screen. From left to right it shows:

    • The marking, such as CUI, when the banner is on.
    • The environment and the enclave, AWS GovCloud (US-West) and CUI enclave in the example. Hovering shows the network note, No outbound internet. Egress is denied at the VPC.
    • No outbound internet.
    • The collectors, such as 13 of 15 collectors reporting: online collectors out of those enrolled. The dot is green only when every enrolled collector is online, and selecting it opens Vehicle collectors.
    • The version, Foxborne 1.4.2 in the example.
    • A UTC clock that ticks every second, with a Z after the time.

    Windows narrower than 1,180 px hide No outbound internet and the version.

  2. Follow the sidebar counts

    • Incidents counts the incidents that are not closed.
    • Runs reads n parsing while imports are being parsed.
    • Sources shows an amber count of sources that need attention or report an error, with a tooltip such as 1 source needs attention.
    • Integrations, under Connect, counts deliveries in the dead-letter queue in amber, with a tooltip such as 1 delivery is in the dead-letter queue.
    • Automations counts automation runs waiting for a named approver, with a tooltip such as 1 held for approval.

    A count disappears at zero. The deployment button at the foot of the sidebar reads Self-hosted, CUI enclave in the example, and it opens Hosting.

  3. Check Sources

    Open Sources. Each connection shows Last sync, a Today count of new files and a Status: Healthy, Needs attention, Paused or Error. Open a row to read its drawer, with the connection details, the activity and any status note.

  4. Check the collectors

    Open the Vehicle collectors tab. The summary strip counts Enrolled, Online, Buffering offline, Offline and Clock warnings, and gives the Collector version. Clock warnings turns amber when any collector's clock is not synchronized.

    Each row shows the vehicle's Clock, Local spool, Last upload, Dropped and State.

  5. Check runs that need attention

    Open Runs and filter by Needs attention, which shows quarantined and rejected runs. Each run page states the reason, and Replace the file opens Import files.

  6. Check Hosting

    On Hosting, confirm Signature verified beside Version and Healthy on each row under Nodes. Then read the Last backup and Restore tested on line, the key's last rotation and the Outbound connections list.

    Outbound connections opens with four fixed rows: Foxborne, Inc., map and tile services, the identity provider and your SIEM. Below them, each destination whose egress an admin turned on in Integrations gets a row. The row names what goes there, the host and the data class.

    A destination inside your network reads Internal, and one reached outside it reads Outbound in amber. The panel's footer reads Egress is off by default, and an admin turns on each one.

  7. Read the audit log

    The audit log records every import, view, edit, export and administrative change. Filter it by Administration to see changes to hosting, access, sources, rules and settings. Verify chain recomputes every hash, and the note reads Chain intact when every entry matches.

What a healthy deployment shows#

  • The collectors segment of the status bar has a green dot.
  • The sidebar shows no count on Sources or Integrations, and each connection reads Healthy or a Paused state you chose.
  • Runs shows nothing under Needs attention.
  • Hosting shows Signature verified, every node Healthy and a Last backup inside your schedule.
  • The four fixed rows of Outbound connections read None, None, Inbound and Internal. Every row after them is a destination your program approved.
  • The audit log reads Chain intact.

Signals and what to do#

SignalWhere it showsWhat to do
Amber dot on the collectors segmentStatus barSelect it to open Vehicle collectors, then read the State column.
Amber count on SourcesSidebarOpen Sources and find the row that reads Needs attention or Error.
Amber count on IntegrationsSidebarOpen Integrations, Delivery ledger, read why the delivery failed and select Replay once the destination answers. See Egress, data classes and the delivery ledger.
Count on AutomationsSidebarAn automation run is Held for approval. A named approver reviews it, as Automations describes.
Needs attentionSources, StatusOpen the source. The note in its drawer says why, for example a buffering vehicle or an unsynchronized clock.
ErrorSources, StatusCheck Location, Access and Credential in the drawer, then select Sync now.
PausedSources, StatusSelect Resume when the source is ready. Files already imported stay as they are.
Last sync older than the scheduleSourcesCompare it with the source's Schedule, such as Poll every 5 minutes, and select Sync now.
BufferingVehicle collectors, StateWait for the link. Uploads resume on their own, and nothing is lost unless the spool budget fills.
OfflineVehicle collectors, StateRead the note under the chip, such as In maintenance since 24 Sep in the example.
Clock warnings above 0 or Not synchronisedVehicle collectorschrony on that vehicle has no reachable time source. Fix it, and align recorded runs by hand.
Dropped in amberVehicle collectorsThe spool budget filled, and the oldest low-priority samples were dropped and marked. Raise the budget in Collector policy, Edit policy.
No SYSTEM_TIME beside a versionVehicle collectors, CollectorSelect Update, then Schedule update.
Quarantined or RejectedRuns, Needs attentionOpen the run, read the reason and select Replace the file.
PartialRuns, ImportA source is missing. Findings that depend on it are not produced, and reports list the gap under Limitations.
n parsingSidebar, RunsNothing. Parsing finishes on its own.
Signature verifiedHosting, VersionConfirm the version is the release you installed.
Healthy on each nodeHosting, NodesThe application, workers and database rows should each read Healthy.
Last backupHosting, Nodes footerIf it is older than your schedule, check the job in your backup service.
Restore tested onHosting, Nodes footerTest a restore on your schedule, as in Backups and recovery.
Rotation, with its last dateHosting, Encryption keyConfirm the last rotation matches your key policy.
Outbound connectionsHostingCompare every row with your egress rules. Foxborne, Inc. and map and tile services must read None, and each added row must be a destination your program approved.
Outbound in amberHosting, Outbound connectionsThe destination is reached outside your network. Confirm its data class and host with the admin who turned it on in Integrations.
License seats and renewalHosting, summaryPlan the renewal before the date shown, 30 Jun 2027 in the example.
Last sync under ProvisioningAccess, Sign-inIf it is old, check SCIM in your identity provider. Removing someone there removes them here within five minutes.
Chain intactAudit logSelect Verify chain on your schedule. The check is recorded as Verified audit chain.
A break-glass sign-inAudit log and your SIEMConfirm it was planned. Every break-glass sign-in is audited and raises an alert in your SIEM.

Next#