Rapid7 Event Sources

InsightIDR Event Sources
1

Some of my Rapid7 event sources are giving me the inactivity notice after I moved them to a second data collector. I have deleted them from the first data collector and only kept 1 in the second data collector. Does anyone know why it is inactive after I moved to the new data collector?

PS: it is working just fine before I moved it.

2

Are these port watcher based event sources or something else?

David

3

This is a good point. If you are enforcing Windows FW rules with tcp/udp ports specifically allowed you will need to recreate on collector2