Integration runs

Navigate to Event Ingestion Common > Integration Runs. An integration run takes place every minute and captures details regarding the events ingested during the scheduled job.

You can see the list of integration runs and status of each run (Success, Timed-out, Waiting) and the number of security incidents that were created. Click on the Number link to drill down to the detailed Integration Run page.

You can view details like the number of events that were ingested, the status, which event that was transformed into a security incident, and the different tasks there were performed during the ingestion. Additionally, you can click the link to view the flow execution details.

Flow execution details

Click the execution details link to see the flow associated with the event ingestion.

You can view a step by step execution of the flow detailing the various actions and subflows that were executed as part of the flow.