siem

I have noticed when ingesting backlog(older timestamped data) that the "Messages per minute" line graph and "sources" data do not line up.

The Messages per minute appear to be correct for the ingest rate, but the sources breakdown below it only show messages for each type from within the time window via timestamp. This means in the last hour if you've ingested logs from 2 days ago, the data is

The generic Windows audit log config lacks many event ids, e.g.

• registry events
• driver load service addition events, System/7045 and Security/4697
• likely others

With CAF 0.18, actor names must be constant strings. The active and passive partition carry their human-readable name in the variable self->state.name already.

In active_partition.cpp and passive_partition.cpp we currently have a lot of log messages using the actor name rather than the human-readable partition name. We need to change them like this:

  VAST_DEBUG("{} persists p

https://en.wikipedia.org/wiki/Local_outlier_factor