Outcomes in Read reports for federated read matching - Security Center 5.9

Security Center Administrator Guide 5.9

Applies to
Security Center 5.9
Last updated
2022-09-12
Content type
Guides > Administrator guides
Language
English (United States)
Product
Security Center
Version
5.9

The following scenarios lists all the possible outcomes in Read reports when the federated read matching feature is activated.

When you configure the federated reads matching feature on the Federation™ host, the Reads and Hits reports can display multiple outputs for a single incoming read. The following use cases demonstrate the different outputs that can be displayed in the reports:

When all entities are online

The number of reads or hits generated depends on which hotlists the incoming read raises a hit against. The following table summarizes how the reports displays the outcomes:
If the incoming plate read is a hit against Reports display
  • Federation™ host hotlist
  • One read from the federated site
  • One hit from the Federation™ host
  • Federation™ host hotlist
  • Federated site hotlist
  • One read from the federated site
  • One hit from the Federation™ host
  • One hit from the federated site
  • No hotlist
  • One read from the federated site

When the federated role is offline or has been deleted

The Reads and Hits reports display federated reads and hits that meet the following criteria:

  • Detected before the federated entity went offline or was deleted.
  • Received within the retention period of the Federation™ host's Security Center.

The following table shows how retention periods affect the Reads report:

Retention periods
Retention period expired on host Retention period expired on site Reads report displays Hits report displays
No No Reads from either the Federation™ host or federated site Hits from either the Federation™ host or federated site
No Yes Reads from the Federation™ host Hits from the Federation™ host
Yes No Reads from the Federation™ Hits from the Federation™
Yes Yes None None