DET-H4: Collector stopped reporting or moved hardware¶
A collector missed an hour of reports, or its key vouched for a different CPU than before.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector liveness |
| Related check | SNP-CERT-01: SEV-SNP report is signed by genuine AMD hardware |
Fires when¶
collector silent past the stall window OR its key reported from a different chip
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.