This topic discusses how to find the system settings window and your edit options, which include aliasing the system name, disabling (or enabling) the system, and removing the system.

Find the system settings

To access settings for an individual system:

  1. Click on the system icon or object anywhere in the Unomaly interface to open the system’s “Profile”.

  2. Choose the “Settings” tab in the window.

The settings that you can change include: changing the state of the system, adjusting “Advanced” tokenization settings on the system, and adding an alias to the system name. The settings view also shows you the groups that the system is a member of.

Add a system alias

Unomaly derives the default name of a system from the data it receives from that system. This means that the display name for a system can depend on how that system sends its data to Unomaly.

You can add an alias to the system name to make it more descriptive and informative. For example, if the default name for one of your web servers is an IP address, such as 10.8.0.1, you can alias it to display as web01.company.com.

Change the state of a system

A system can have one of three states: Active (enabled), Training, or Disabled.

Unomaly analyzes data from systems that are Active or in Training. If you change the system state to “Disabled”, Unomaly stops analyzing the data from that system and the system no longer consumes a license. You can also add Active systems back into Training.

Although the “last seen” statistics continue to update whenever the Unomaly instance receives data from the disabled system, the data will not be analyzed. Disabling a system does not affect previously consumed data, learned profiles, and detected anomalies.

Remove a system

Removing a system means deleting everything the Unomaly instance has gathered about the system, including the data and the behavioral statistics.

To permanently remove a system:

  1. Configure the system to stop sending data to the Unomaly instance.

  2. In the system’s settings, remove the system from the Unomaly instance.

If the removed system continues to send data to Unomaly, the instance will automatically add the system (as a new system) the next time it receives data from that system.