Documentation Center
AlienVault® USM Appliance™

Setting Up Alarm Forwarding

Important: Note that the configurations outlined in this section are very important. This is the section that most of our partners have problems with. Not taking this section seriously can result in massive headaches and turn into a time-suck. Please proceed with care.

Forwarding and Federation

AlienVault uses the term forwarding to describe the transfer of information from one USM Appliance Server to another. Forwarding can send alarms and/or events not only to other USM Appliance Servers but to USM Appliance Loggers as well. In a federated setup, the best practice is to forward alarms only, because forwarding events in such a scenario can lead to performance degradation and there is no effective way to distinguish one client's events from the other. 

After you have set up alarm forwarding, you will see a combined view of all alarms on your Federated Server. AlarmsAlarms provide notification of an event or sequence of events that require attention or investigation. will have a tag attached to them with their origin. This will help you identify which customers generate each alarm.

Important: All servers involved in alarm forwarding, the Federation Server and the customer's USM Appliance Server, must be on the same version.