Verify the Microsoft Threat and Vulnerability Management integration import run status
Use the Microsoft Threat and Vulnerability Management (MS TVM) import run status to verify the success of your integration runs and to locate any issues.
Before you begin
This procedure makes the following assumptions:
Role required: sn_vul.vulnerability_admin- You have Vulnerability Response and the MS TVM Vulnerability Integration installed and configured.
- MS TVM Vulnerability Integration imports are scheduled and running.
About this task
During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the
data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite
the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated
based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also
older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.
Note:
The Last Record Processed field is updated based on
what is defined in the following system properties:
- sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
- sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.