When aUser and Entity Behavior Analytics (UEBA) agentisoff-net, meaning it is disconnected from the network and cannot reach the FortiSIEM collector, ittemporarily stores (caches) events locallyuntil it can re-establish a connection.
● This caching mechanismprevents data lossby ensuring events are retained even when the agent is offline.
● Once the connection to theFortiSIEM collector is restored, the agentuploads the cached events.
● This ensurescontinuity in user behavior monitoring, even when users are disconnected.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit