SSIM, Version 4.7.0-b238, Visualizer, Table View issue.
We had trouble earlier today; disabled a Correlation Rule for which Alerts were enabled. When we began receiving email notices of events related to that rule, we thought the Rule had not been properly disabled.
We were eventually able to stop the alerts and disable the rule.
I began cleaning up (closing) numerous alerts, basically housekeeping, many realted to the disabled rule, and also several thousand others.
After cleanup, we noticed that the Status for most Hosts in the Table View of Visualizer showed as Unknown and a few showing Clock out of Sync. Currently, the Host's that were initially Clock out of Syc are showing Agent Down or Sensor Down.
We have verified that these devices are indeed Up and have traffic, observed in the Statistics view.
It has been a few hours since this happened. Is it possible there is a lag somewhere and the SIM is "preoccupied"?
Any ideas why the Table View is not communicating?