Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt

Use this file to discover all available pages before exploring further.

Integration health is visible on the Integrations settings page, each integration’s detail page, and the home dashboard.
Wirespeed continuously monitors every connected integration and surfaces its health status across the platform. If a detection source stops ingesting data, a containment action starts failing, or a log feed goes quiet, you will see it immediately before it affects a case or an automated response. Health statuses are evaluated automatically on an ongoing basis. No configuration is required.

​
Health Statuses

StatusBadge ColorMeaning
HealthyGreenThe integration is operating normally with no recent errors or warnings.
UnstableYellowThe integration is experiencing intermittent errors or an elevated volume of warnings.
UnhealthyRedThe integration has persistent failures that may prevent it from delivering data or executing actions reliably.
PendingGrayHealth data is still being collected, the integration is in a maintenance window, or the integration type is not subject to health monitoring.

​
Where Health Is Displayed

​
Dashboard

The home dashboard includes a health distribution bar at the top of the Integrations card. The bar shows a color-coded breakdown of all connected integrations by health status. Clicking any segment navigates directly to the integrations list filtered to that status. Integrations in the dashboard list are sorted with Unhealthy integrations first, followed by Unstable, then Healthy, then Pending. Empty status groups are hidden.

​
Integrations List

Every row in the integrations list on the Integrations settings page displays a health badge. The list is sorted by health status by default, so integrations that need attention appear at the top. Hovering over an Unhealthy or Unstable badge shows a tooltip with the number of errors or warnings detected and when the current status began. You can also filter the integrations list by health status using the filter bar above the table.

​
Integration Detail Page

Opening an individual integration displays its health badge in the page header. If the integration is Unhealthy or Unstable, a banner appears below the header with context-specific messaging:
  • Unhealthy (critical-tier integration): For detection sources, log sources, endpoint agents, and identity providers, the banner notes that the integration may be unable to send or receive data reliably, including automated remediation actions, and prompts you to check configuration or contact support.
  • Unhealthy (other integration types): The banner notes how long the integration has been failing.
  • Unstable: The banner notes that the integration is experiencing intermittent failures and shows when the status last changed.
If the vendor publishes a status page, a link to it is included in the banner.

​
30-Day Activity Panel

The integrations settings page includes a health panel above the integration list with two views:
  • Donut chart — shows the current count of integrations in each health status.
  • Activity bar — a single proportional bar showing the aggregate volume of Successes (green), Warnings (yellow), and Errors (red) logged across all integrations over the last 30 days. Hovering over a segment shows the total count for that type and the top contributing integrations by volume. Clicking the Errors or Warnings segment navigates to the integrations list filtered to the corresponding health status.

​
How Health Is Determined

Wirespeed evaluates health based on recent activity logs from each integration. The evaluation runs automatically every hour. The system applies different thresholds depending on what an integration does:
  • Detection and log sources (e.g. CrowdStrike, SentinelOne, Microsoft Defender) are monitored most aggressively. Errors that persist for 4 hours, or a high error rate within a single hour, will trigger an Unhealthy status.
  • Endpoint agents and identity providers (e.g. Jamf Pro, Okta, Entra ID) are flagged as Unhealthy if errors occur on three consecutive calendar days.
  • Containment actions, notification delivery, webhooks, and ticketing (e.g. endpoint isolation, user disable, Slack message delivery, Jira) are flagged as Unhealthy after errors persist for 4 hours.
  • Enrichment integrations (e.g. threat intelligence, IP lookup, file reputation) are given a longer window — errors must persist for 24 hours before the integration is marked Unhealthy.
An integration will not immediately return to Healthy after an issue is resolved. Wirespeed requires a 24-hour quiet period with no errors or warnings in the affected areas before the status clears. This prevents flapping caused by transient recoveries. Integrations in a configured maintenance window show as Pending during that period and are excluded from health evaluation.

​
Email Notifications

Email notifications for health transitions are currently rolling out gradually and may not yet be enabled for all accounts. The in-app badges, banners, dashboard bar, and activity panel are available to all customers now.
When email notifications are enabled for your account, Wirespeed will send an alert when an integration transitions to a new health state:
  • Unhealthy — sent when an integration crosses the failure threshold for its type.
  • Unstable — sent when an integration begins showing intermittent errors or elevated warnings.
  • Recovered — sent when an integration returns to Healthy after a period of Unhealthy or Unstable status.
Notifications respect integration-level muting. If an integration has been muted by an operator, health transition emails will not be sent for that integration.

​
FAQ

Pending means health data is still being collected for that integration, the integration is in an active maintenance window, or the integration type is not subject to health monitoring. For newly connected integrations, the status will update within the first evaluation cycle.
It depends on the integration type. Detection and log sources are marked Unhealthy after 4 hours of persistent errors or a high error rate within a single hour. Endpoint agents and identity providers are marked Unhealthy after errors on three consecutive calendar days. Containment, notification, and ticketing integrations are marked Unhealthy after 4 hours. Enrichment integrations require 24 hours of persistent errors before becoming Unhealthy.
Wirespeed requires a 24-hour quiet period with no errors or warnings before an integration returns to Healthy. This prevents the status from flapping during partial recoveries. If the integration has been clean for more than 24 hours and the status has not updated, try triggering a manual health check from the Integrations settings page.
Yes. When email notifications are enabled for your account, Wirespeed sends a recovery notification when an integration returns to Healthy after being Unhealthy or Unstable.
Slack, Teams, and Email integrations are monitored at the same level as containment integrations. They will typically show as Healthy when message delivery is functioning normally, and may show Unstable or Unhealthy if message delivery fails persistently.