Hi,
I have created IoT role, SNS topic on AWS IoT console and activated email subscription for SNS notification. I have configured below security profile for Device Defender Could-Side metrics .
i am receiving SNS email notification from AWS, even though device sends less than 5messages in 5minutes. below is the email received for any number( <5, >5, =5) of messages sent from device.
How can i configure SNS in such way that i receive email notifications only when device violates the predefined behaviour of security profile created on AWS IoT console.
If you look at the message, it says metric count value is 7. When you say only one message is sent, are you counting all the messages like CONNECT, SUBSCRIBE, PING etc?
Hi,
In below AWS SNS email notification received, I have set my device metrics as 1 as in below screenshot for established tcp connections count, but still i am receiving notification even though my device has only one tcp connection established.
That is the problem. What you are seeing is Missing Datapoint alarm because you stop sending this metric. You need to ensure that the networking metrics are sent periodically forever.
I am receiving SNS email notification, when my sends more than 7messages and less than messages also, which i didn’t want it to be. As per my understanding i should receive email notification only when my device violates defined metrics behaviour in security profile. Below are screenshots of email i received in both cases.
when device sends 9 messages—
With Rules Detect behaviors, you define how your devices should behave
To be more clear, the behavior that you describe in security profile, specifies the behavior that, when violated by a device (thing), will cause an alert. So in your case, number of messages >= 7 is normal behavior and number of messages < 7 is violation.
Now, if you look at the notifications that you get -
The first notification is alarm-cleared (look at violationEventType) which tells you that the metric was in violation before and is not in violation anymore. This probably means that the device sent <7 messages before causing the metric to go in alarm state and later the device sent 9 messages, which brought the metric out of alarm.
The second notification is ;in-alarm` which tells you that the metric is in violation. This is true because 3 is less than 7 and is therfore, a violation of the specidifed behaviour.
I am not sure that can be done. Why do you want to do that? Those notifications do provide you valuable information when you are investigating an issue - they tell you that you have fixed an issue.
