Advanced security monitoring
For a missing alert, ask whether its underlying logs exist. Find a known test event by time, gateway and action on the Log Server. If there are no matching logs, investigate logging and delivery before adjusting a SmartEvent threshold.
If the logs exist, examine the installed Event Policy. The correlation unit evaluates log fields against definitions. For threshold-based events, check how logs are grouped, the time window and the required count. Replay a small positive test that should create an event and a negative test that falls just below the threshold.