After getting Aanval installed, set up, and sensors connected, users sometimes ask: “Why aren’t I seeing any events?”
Not a problem. Aanval 8 is loaded with new security and analytical tools. If you aren’t seeing your sensor’s events, first go to the Configuration Menu and select the proper import module (Unified2 Module, MySQL Module, Syslog Module). Under each module you’ll find Sensor Configuration.
After going to Sensor Configuration, choose the sensor in question. At the bottom of the menu you’ll see Sensor Permissions. These options allow admins to securely limit access to active sensors. When a box is unchecked for a given user, that user will not be able to view or manage event data for that sensor.
Make sure the chosen sensor’s Sensor Permissions are enabled for the desired user.
Aanval 8 further allows users to quickly filter sensor data on any menu, so that, for example, when viewing Frequent Offenders on the Charts menu, users can disable the view of certain sensors to focus on particular areas of the network, while sensor importing and functionality remains active in the background, just out of view.
Once Sensor Permissions are enabled, hover over the name of the logged-in user to view the drop-down menu and select Change Sensors View.
Once selected, all sensors that are both active and have the Sensor Permissions enabled for that logged-in user will be displayed. Check the box of each sensor for which you want to view and manage event data.
Once sensors are checked, event data will be immediately displayed. If after taking these steps you still do not see event data, start with making sure your sensors are active, properly logging in the Unified2 or syslog formats, depending on which sensor you’re troubleshooting, and that sensors are properly connected to Aanval.