Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Pausing Telemetry

Pause the collection or reporting of telemetry

Pausing Sources and Destinations

By default, telemetry is collected from all sources in a configuration and sent to all supported destinations in that configuration. However, there may be times when you don't want to collect from a certain source or export to a destination. To support those situations, Bindplane allows you to "Pause" sources and destinations. When a source is paused, collectors won't try to collect from it. When a destination is paused, no collected telemetry will be sent to it.

An important detail to remember is that pausing or resuming a source or destination in a configuration will update all collectors using that configuration to pause/resume that source/destination.

Pausing a Source

Sources can be paused from the page of either an Collector or its configuration. To pause a source, click on the card for the source you want to pause in the topology view. Its current status will be shown in the bottom left corner, either Running or Paused. If running, clicking the Pause button will pause collection of that source.

observIQ docs - Pausing Telemetry - image 1

After clicking "Pause", the topology reflects that the Active Directory source has been paused.

observIQ docs - Pausing Telemetry - image 2

Pausing a Destination

Destinations can be paused like sources, by clicking on the appropriate card in the topology view of a configuration. Its current status will be shown in the bottom left corner, either Running or Paused. If running, clicking the Pause button will pause the sending of telemetry to that destination. If the only destination in a configuration is paused, the collector will also pause collecting all sources as the telemetry has nowhere to go.

A major difference between pausing sources and destinations is that while pausing a source only affects that configuration, pausing a destination will pause it in all configurations including it. For example, imagine a single Google Cloud Monitoring destination, example-gcp-project, is being used in several configurations to send telemetry to that GCP project. If you need to stop all telemetry from being sent, pausing the example-gcp-project destination in one configuration will pause it in all other configurations.

observIQ docs - Pausing Telemetry - image 3

After clicking "Pause", the topology reflects that the Gcloud-qa destination has been paused.

observIQ docs - Pausing Telemetry - image 4