Step-by-step tutorials for onboarding devices, configuring vendor protocols, tuning detection rules, and wiring up alerting, written as a working reference for how the product should behave.
The fastest path from a new Linivo account to a sensor reporting live telemetry and its first detection.
Sensors are the bridge between your network and Linivo Cloud, feeding both monitoring and detection. Here's how to size, place and install one.
What to open, what to leave closed, and how the sensor fits into a network that already has firewalls, VPNs and segmentation in place.
The core workflow every other tutorial in this section builds on: getting one device from "not monitored" to reporting data and detections.
Lateral-movement detection flags east-west traffic between hosts that don't normally talk. Here's how to reduce false positives without losing real signal.
New devices joining the network are checked against your provisioned inventory. Here's how to define what "provisioned" means for your team.
Sequential or unusual connection attempts across a range of ports and hosts get surfaced as a detection instead of getting lost in normal traffic noise.
Correlation groups related symptoms into one incident instead of paging on each one. Here's how to make sure it understands your topology correctly.
A maintenance window should suppress the alerts a planned change causes, and nothing else. Here's how to scope one correctly.
Enable SNMPv3 polling on Cisco IOS so Linivo can collect interface, CPU and memory metrics.
Export NetFlow v9 from a Cisco router so Linivo can build traffic analysis and lateral-movement detection from real flow data.
Forward device logs to Linivo with TLS encryption instead of plaintext UDP, so log contents aren't exposed on the wire.
Poll Windows Server metrics natively over WMI, without installing a third-party agent on every machine.
Configure Linivo as a detection source feeding a SOC, with the right routing, retention and access model for that workflow.
Deploy sensors per site, group devices logically, and get one consolidated view across every location.
Monitor and detect across on-prem infrastructure and cloud VPCs from the same platform, without two separate tools.
Make sure alerting, on-call routing and access work cleanly across time zones with no single office network to depend on.
Configure retention, exports and access logging to match what an auditor will actually ask for.
Route alerts and detections to Slack channels, scoped by severity or category so the right channel gets the right noise.
Automatically create Jira issues from detections or alerts, so incident follow-up lives where your team already tracks work.
Send critical detections and alerts into an existing on-call rotation instead of building a second one inside Linivo.
Let your team sign in with your existing identity provider instead of managing separate Linivo passwords.
Turn on SNMP polling in the iDRAC9 web console so Linivo can read chassis health, power draw and hardware sensors out-of-band.
Redfish gives richer, better-typed hardware data than SNMP on newer iDRAC firmware. Here's when to use it and how to point Linivo at it.
Polling catches most things, but iDRAC traps deliver hardware failures (a failed PSU, a degraded RAID member) the moment they happen instead of on the next poll cycle.
Turn on the SNMP agent in iLO 5 so Linivo can read HPE ProLiant hardware health without installing agents on the host OS.
iLO 5 and iLO 6 both expose a full Redfish API alongside SNMP, with more granular thermal and power data than the HPE hardware MIB.
Lenovo's XCC (used on ThinkSystem servers) supports SNMP alongside Redfish. Here's where the setting lives, since it's named differently than Dell or HPE's equivalent.
Supermicro's web-based IPMI interface exposes SNMP under its Configuration menu. Here's how to turn it on and what it reports.
Some older or stripped-down BMCs don't expose SNMP at all. ipmitool over the network (IPMI LAN) is the fallback Linivo's sensor can use instead.
Cisco UCS servers expose hardware health through CIMC on standalone boxes, or centrally through UCS Manager on a managed chassis.
Most modern servers support all three ways of reporting out-of-band health. Here's the tradeoff Linivo customers actually run into when choosing.
APC's Network Management Card exposes battery status, load and runtime over SNMP. Here's how to turn it on and what Linivo reads from it.
APC's switched and metered rack PDUs report per-outlet power draw over SNMP, separate from the UPS MIB used by APC's UPS line.
Eaton's Network-M2 management card is the SNMP path for Eaton 9PX, 9SX and BladeUPS lines.
Tripp Lite's network-enabled PDUs use a similar SNMP model to APC's, with their own MIB for per-outlet and per-bank load.
Vertiv's rack PDU line (formerly Liebert) uses its own MIB, distinct from the cooling-unit MIB used on Vertiv's CRAC/CRAH lineup.
The default thresholds catch a UPS that's already failed. Here's how to tune them to catch one that's degrading.
Bank-level PDU monitoring tells you a rack's total draw. Outlet-level monitoring tells you which specific device is drawing it.
Adding one more server to a rack that's already near its circuit's rated capacity is how you trip a breaker at the worst possible time.
Synology's DSM exposes disk health, volume usage and system status over SNMP once it's turned on in Control Panel.
QNAP's QTS has its own SNMP toggle and MIB, structured differently from Synology's despite doing the same job.
ONTAP exposes SNMP at the cluster level. Here's how to enable it and what it's good for versus ONTAP's own REST API.
TrueNAS has a built-in SNMP service under its System Settings, reporting ZFS pool and disk health once turned on.
Rack-mounted SAN and DAS arrays typically expose a management controller with its own SNMP agent, separate from any host that consumes the storage.
Most RAID controllers report state changes as generic strings. Here's how to turn that into an alert that actually tells you what to do.
A SAN with plenty of free space can still be the reason an application is slow. Latency, not capacity, is usually the first sign of a storage problem.
FortiGate's SNMP configuration lives under System > SNMP in FortiOS, with separate community and host-access settings.
PAN-OS SNMP setup is split across a network profile and a management-interface service permission, which trips people up the first time.
RouterOS's SNMP setup is a single command or a short menu in Winbox, but a few defaults are worth changing before exposing it.
UniFi switches and gateways take their SNMP configuration from the UniFi Network controller, not from each device individually.
Aruba's AOS-CX and AOS-Switch product lines both support SNMP, with slightly different CLI syntax between the two families.
Junos SNMP configuration follows Juniper's structured configuration model, committed like any other change.
Meraki gear is cloud-managed and doesn't expose local SNMP by default the way on-prem switches do. The Meraki dashboard API is the path Linivo uses instead.
ASA's SNMP setup is similar to IOS but scoped to whichever interface you configure it on, which is easy to get wrong on a multi-context firewall.
Both open-source firewall platforms bundle Net-SNMP and expose the same toggle under Services in their web UI.
A firewall reporting healthy doesn't mean the tunnel it's terminating is up. Here's how to alert on tunnel state specifically.
vCenter doesn't expose SNMP by default for most host and VM metrics; Linivo polls it through the vSphere API instead.
Hyper-V host and VM metrics are available through the same WMI path used for other Windows Server monitoring, plus Hyper-V's own WMI namespace.
Proxmox VE exposes a full REST API that Linivo uses to poll node, VM and container metrics across a cluster.
Nutanix clusters are polled through Prism's REST API rather than per-node SNMP, covering both the AHV hypervisor and the underlying cluster storage fabric.
XenServer/Citrix Hypervisor hosts can be monitored over SNMP for host-level metrics, with XenCenter or the xe CLI for anything VM-specific.
A VM-level CPU or memory alert that fires every time the host is busy isn't telling you anything about that specific VM.
Standalone environmental sensors (rack-mount or DIN-rail) almost universally expose SNMP, using either a generic MIB or one specific to the sensor vendor.
Rope- or spot-style leak sensors report a binary or short-cable-length state over SNMP, and are worth alerting on immediately rather than waiting for a scheduled poll.
Precision cooling units (from Vertiv/Liebert, Stulz, Schneider and others) expose SNMP for supply/return temperature, humidity and unit status.
Electronic rack locks and door sensors typically report state changes over SNMP or a vendor webhook, useful for both security and simple "was this rack opened" auditing.
Data center smoke detection is usually its own certified fire-suppression system, not something Linivo replaces. Here's the right way to bring its alerts in as a signal, not a controller.
A closet with three switches and a proper data hall with hot/cold aisles need very different temperature and humidity thresholds, and the defaults split the difference badly for both.
Almost every network printer, regardless of brand, supports RFC 3805's standard Printer MIB, which is the protocol-level approach Linivo uses rather than a vendor-specific one.
The Printer MIB reports consumable levels as a percentage, which makes a genuinely useful early-warning alert straightforward to set up.
MFPs report more than a standalone printer: scanner, fax modem and finisher status all have their own MIB branches worth watching separately.
Card and badge readers on a building access system are network peripherals like any other, and their connectivity is worth monitoring the same way.
Linivo can pull CloudWatch metrics through a read-only IAM role, so EC2, RDS and load-balancer health sit in the same timeline as your on-prem devices.
Azure Monitor's metrics are pulled through a service principal with reader access, the Azure equivalent of AWS's read-only IAM role approach.
GCP's path uses a service account with the Monitoring Viewer role, following the same least-privilege pattern as the AWS and Azure integrations.
Kubernetes doesn't speak SNMP; Linivo's cluster integration reads from the Kubernetes API and metrics-server instead, the same sources kubectl top uses.