Routes: Management

The Routes web interface provides comprehensive management for data flow orchestration through two distinct approaches: Quick Routes for simple configurations and Advanced Routes for complex routing logic.

Access

Navigate to Home > Routes, or use the hamburger menu and select Routes.

Overview

The Routes interface is where you orchestrate data flow from devices through pipelines to targets. Routes act as traffic controllers, determining what data goes through which processing pipelines and reaches which destinations.

DataStream provides two route types:

Aspect	Quick Routes	Advanced Routes
Interface	Visual drag-and-drop	Multi-step wizard
Complexity	Simple device-to-target	Complex filtering, conditional logic
Directors	All Directors	Selectable Directors
Scheduling	Continuous only	Cron or interval scheduling
Best for	Straightforward data flows	Enterprise routing scenarios
Route configuration	Optional YAML on a route with a pipeline	A wizard step

Quick Routes

Quick Routes provides a visual interface for creating simple data flows with drag-and-drop functionality.

Interface

The Quick Routes page displays an interactive flow canvas showing connections between devices and targets. Devices render as nodes on the left side, targets on the right, with connection nodes between them — either direct or pipeline-mediated.

When no devices or targets have been added yet, a panel offers Select device and Select target buttons to start building the flow.

Creating

Add Device to Flow:

1. Click Select device
2. A two-step drawer opens: Choose Device Type (tile selection), then Select Device (pick devices from a table)
3. The selected device appears as a node on the canvas

Add Target to Flow:

1. Click Select target
2. A drawer opens for target type and target selection
3. The selected target appears as a node on the canvas

Connect Device to Target:

Draw a connection by dragging from the device node's handle to the target node's handle on the canvas. The connection appears as a route node between the two.

Add Pipeline to Connection:

1. Click the connection node between device and target
2. The Insert from available pipelines modal appears
3. Choose a pipeline from the list
4. Click Select pipeline to add it to the connection
5. The pipeline name appears on the connection node
6. Data flows through: Device → Pipeline → Target

Managing

View Route Details:

• Click a connection node on the canvas (labeled Direct route or with the pipeline name) to open a configuration popup with route details and options

Remove Pipeline from Route:

1. Open the connection node's popup
2. Remove the pipeline; the connection reverts to direct device-to-target flow

Set Route Configuration:

1. Open the connection node's popup. The route must have a pipeline; the link is not there for a direct route
2. Click Set route configuration (it reads Edit route configuration once the route has one)
3. The Route configuration modal opens. Enter the YAML — the same document as an Advanced Route's Route Configuration — and click Apply
4. Click Save route in the popup

The configuration is saved with the route; until then it is a draft, like a newly picked pipeline. Removing the pipeline from a route removes its configuration as well. Clearing the editor and saving removes it.

Delete Route:

1. Open the connection node's popup and choose to remove the route
2. The Remove Route modal appears
3. Click Remove route to confirm
4. The connection disappears from the canvas

Remove Device:

1. Select the device node on the canvas and choose removal
2. The Remove device from routes modal appears
3. Click Remove device to confirm
4. All routes using this device are deleted

Remove Target:

1. Select the target node on the canvas and choose removal
2. The Remove target from routes modal appears
3. Click Remove target to confirm
4. All routes using this target are deleted

Advanced Routes

Advanced Routes provides a wizard-based interface for creating complex routing configurations with filtering, director selection, and scheduling.

List

The Advanced Routes page displays a table of all configured advanced routes.

The table displays Name, Description, Pipeline, Config, Directors, Log Stream, Status (Enabled/Disabled), and an Actions menu (⋮) for each route.

Log Stream is a sparkline of the route's recent throughput, so a route carrying nothing is visible at a glance without opening it.

Filter routes using Search advanced routes (by name) and Status dropdown (All, Enabled, Disabled). The Refresh button reloads table data. Click Add new route to launch the creation wizard.

Actions

Each route row provides an Actions menu (⋮) with the following operations:

View and Edit:

• Manage route - Navigate to the route detail view
• Clone route - Open the creation wizard pre-filled with a copy of the route (name prefixed "Copy of")
• See route details - Shown instead of the management actions for users with read-only access

Status Management:

• Enable route / Disable route - Toggle route status (shown according to current status)

Deletion:

• Delete route - Remove route from platform

Delivery Issues

A route can be configured correctly and still deliver nothing: if the Directors the route is restricted to cannot reach the Directors its target is restricted to, the target never arrives at the Director, and the router drops the matching records with only a debug-level warning. Nothing about the route looks wrong.

The interface surfaces this rather than leaving it silent:

• Advanced Routes list — a warning icon and badge beside the route Name.
• Advanced Route detail page — a banner at the top listing each affected target and the Directors involved, with a hint at the fix.
• Quick Routes — the same badge on the connection node between the device and the target.

The issue is reported as one of three kinds:

• Unreachable — the route and the target have no Director in common at all.
• Partially unreachable — some of the route's Directors can reach the target and others cannot.
• Target not found — a target_for_* conf value names a target that does not exist in the tenant. Advanced routes only: quick routes reference their target by id, so they cannot hit this.

For the first two, widen the Director restriction on the route or on the target until they overlap. For a missing target, see below.

Target Not Found

Smart packs reroute records with target: "{{{_vmetric.conf.target_for_sentinel}}}", so the value of a target_for_* key is the name of the destination target. A typo, a renamed target, or a target deleted after the route was saved leaves that name pointing at nothing, and the Director drops and counts every record the pack reroutes there.

The issue names the missing target and where the name came from. The Director resolves each key from these sources in order, and the first value found wins:

Source	What it is
route-conf	The route's own conf (properties): an explicit override set on the route
pipeline-default	The fields.conf default shipped in the pack or pipeline the route runs
default-target-pipeline	The fields.conf of the pipeline attached to the route's default target

A route override shadows the pack default for the same key. If the override names a real target, the route is healthy even when the pack's default name does not exist. Pack defaults are often placeholder names — the Microsoft Azure pack, for example, ships azdx, azblob and sentinel_lake — so a route on such a pack, in a tenant without targets of those names, shows pipeline-default issues until it is given overrides or turns those destinations off (see Destinations a Route Turns Off).

Names are matched the way the Director sanitizes target names: case is ignored, and a space counts as an underscore, so Sentinel EU matches sentinel_eu. The route's default target is never reported missing: it is selected by id, and a target assigned to an advanced route cannot be deleted.

Saving a route is never refused because of a missing name. The create and update API responses carry a warnings list with one target not found entry for each target_for_* value in the route's own conf that matches no target, except for destinations the route turns off. Names that come from pack or pipeline defaults are not checked on save; they are reported on the Advanced Routes list and detail page.

To fix it, point the target_for_* override on the route at an existing target, or create the target. If the route should not send to that destination at all, turn it off instead, with use_X: false or an empty target_for_X.

warning

An unresolved delivery issue means the route drops the affected records without failing: everything bound for an unreachable or missing target, or sent from a Director that cannot reach it. It is not a warning about future trouble; it is a report that data is already being lost.

Destinations a Route Turns Off

Smart packs (Microsoft Sentinel, Elastic, Google SecOps, Splunk) send to a target_for_X destination only while its use_X switch is on. A destination the route turns off is sent nothing, so it is not checked. On the Advanced Routes list badge and the detail page banner this applies to all three kinds of delivery issue (unreachable, partially unreachable and target not found). The warnings list in the create and update API responses carries only target not found entries for the route's own target_for_* values, and skips those the route turns off. Quick routes are not affected.

For each destination X:

Route's configuration	Checked against the tenant's targets
target_for_X: my-target	my-target (route-conf)
No target_for_X on the route	The pack's default name (pipeline-default), or failing that the default target's pipeline value (default-target-pipeline)
target_for_X: ""	Nothing: the destination is off, and the pack's default is not checked either
use_X: false	Nothing: whatever name target_for_X resolves to is skipped

• Pairing — the switch pairs with the target key by name: use_lake with target_for_lake, use_sentinel with target_for_sentinel, use_azdx with target_for_azdx, and so on.
• Precedence — the route's value wins over the pack's default, for the target name and for the switch alike. A pack that ships use_X: false turns its own default off, and a route can turn it back on with use_X: true.
• What counts as off — only an explicit false. A missing use_X counts as on.
• use_smart_routing — setting it to false does not exempt any destination from the check, because some pack branches send without reading it.
• Spelling — keys are matched exactly as written, as the Director reads them. Use_Lake: false does not turn off use_lake, and Target_For_Azdx: "" does not empty target_for_azdx.

warning

Turning a destination off silences its issue because the route stops sending there. Switching a destination off to make a banner go away also stops the data that was meant for it.

Create Advanced Route Wizard

The advanced route creation process uses a multi-step wizard with comprehensive configuration.

Details

Configure basic route information and connections.

Route Information (fields in form order):

Route name:

• Unique route identifier
• Minimum 3 characters
• Maximum 64 characters

Route description:

• Optional route explanation
• Describes route purpose
• Maximum 100 characters

Filter (Optional):

• Optional filter expression with an information tooltip
• Determines which events match this route
• Uses expression syntax for conditional matching
• Example: event.type == "security" && event.severity > 3

Select director (Optional):

• MultiSelect of available Directors
• If none are selected, the route runs on all Directors; selecting Directors restricts execution to them

Default target:

• Fallback destination for events that don't match specific targets
• Dropdown showing all configured targets

Select pipeline:

• Required processing pipeline selection
• Searchable dropdown showing all available pipelines
• Route processes all events through this pipeline

Route Status:

• Toggle controlling whether the route processes events
• Enabled: Route processes events
• Disabled: Route is configured but not processing

Route Configuration

The second step presents a YAML code editor (Monaco, with syntax highlighting and theme support) where you enter or paste the route's YAML configuration. This is where device-to-target mappings and conditional routing logic are defined in YAML form (see Routes overview for the configuration schema).

Execution Settings

Configure route scheduling and execution behavior.

Scheduling:

Enable scheduling to run the route at specific times rather than continuous processing.

Scheduling Toggle:

• Scheduling - Activate scheduled execution
• When disabled, route processes data continuously as it arrives
• When enabled, route accumulates data and processes on schedule

Scheduling Method Selection:

Under Scheduling method, choose between two scheduling approaches using radio tiles, Cron-based or Interval-based. A cron-based schedule is set under Cron schedule, with a Pattern dropdown; an interval-based one under Interval schedule, with an Interval dropdown. Choosing Custom in either dropdown opens a field for your own Cron expression or Custom interval.

info

For Cron-based scheduling, see this chapter, for Interval-based scheduling, see this chapter.

Review and Configure

The fourth step presents a read-only summary of all configured settings before the route is created.

Route Details — Displays name, description, pipeline, directors, default target, filter, and status as entered during creation.

Route Configuration — Displays the YAML entered during creation as a read-only code snippet. Shown as "None" when no configuration was entered.

Execution Settings — Displays scheduling state (Enabled/Disabled). When scheduling is enabled, also shows the scheduling method, cron expression, or interval time.

Each section includes an Edit button that navigates directly back to the corresponding step for corrections without losing other entered data.

Navigation

The wizard runs in four steps: Route details, Route configuration, Execution settings, and Review and configure.

Progress Indicator:

• Visual step progress at top of wizard
• Click steps to navigate (after validation)
• Current step highlighted
• Completed steps marked with checkmark

Navigation Buttons:

• Cancel - Exit wizard without creating route (first step; on later steps the left button is Back)
• Next step - Advance to next step with validation
• Add route - Finalize route creation (final step); a success notification confirms creation and you are returned to the Advanced Routes list

Unsaved Changes:

Cancelling the wizard with entered data opens an Unsaved changes modal warning that progress will be lost, with Continue adding (stay in the wizard) and Discard (exit) buttons.

Detail View

Clicking a route from the list opens the detailed management interface.

Tabs

The detail view has six tabs: Route details, Route configuration, Execution settings, Health, Live data, and Activity logs. Health, Live data and Activity logs appear only to users with permission to read statistics, live data and activity logs respectively.

Route Details Tab:

Displays and allows editing of the route configuration entered during creation:

• Route name - Editable route name
• Route description - Editable route description
• Filter (Optional) - Event filtering logic
• Directors - Selected Directors (MultiSelect)
• Default target - Fallback destination
• Select pipeline - Processing pipeline
• Route Status - Enabled/Disabled toggle

Click Manage route details to enter edit mode.

Route Configuration Tab:

Displays the route's raw YAML configuration under the Advanced Route Configuration panel. Click Manage route configuration to enter edit mode and modify the configuration text.

Execution Settings Tab:

Displays and allows editing of the scheduling configuration entered during creation:

Scheduling Section:

• Current scheduling status (Enabled/Disabled)
• Scheduling method (Cron or Interval)
• Current schedule pattern or interval
• Edit mode allows modification of all scheduling settings

Health Tab:

Shows what flows through this route over a time window: where it comes from, where it goes, and what is lost on the way. The window controls are the same as on a Director's Health tab: a preset or custom range, and Live refreshing every 10 seconds for presets of 24 hours or less.

• Tiles — Received (every record the Director handed to the route, counted before the route's filter), Forwarded (what passed the filter and pipelines, as a share of received), Delivered (what the sender confirmed for this route, as a share of forwarded), and Routing losses (filter misses, pipeline drops, evictions and errors)
• Data flow — a flow diagram from the source devices through the route, and its pipelines, to the destination targets, by Events or Bytes. Pipeline stages show in the Events view only
• Throughput — received against forwarded over time, by events or bytes
• Errors & Drops — what the routing hop lost over time, as Errors, Dropped and Evicted
• Sources and Destinations tables — each device's and each target's volume and share; the destinations table adds the delivery hop's own errors, drops and throttled attempts

Deliveries are attributed to a route only when the Director running it is on a build that stamps them with the route, and never for a scheduled target, which batches records from all routes together. Otherwise Delivered is not attributed, and the flow diagram shows the destinations as Not attributed yet.

Live Data Tab:

Captures data flowing through this route in real time, before or after route processing — see Live Data.

Activity Logs Tab:

Lists the operations performed on this route: the user, their IP address, the action and when it happened.

Operations

Enable / Disable

To change route status:

1. Navigate to route detail view or use the Actions menu from list
2. Click Actions menu
3. Select Enable route or Disable route
4. Success notification confirms the status change

Enabled routes process events based on configuration. Disabled routes preserve configuration but stop all processing.

Export Template

1. Navigate to route detail view
2. Click Actions menu
3. Select Export template

The advanced route opens as a Bicep template, to deploy again or to change first. See Export Template.

Delete

Delete Route Process:

Remove a route from the platform:

1. Navigate to route detail view or use Actions menu from list
2. Click Actions menu
3. Select Delete route
4. A confirmation modal appears showing the route name
5. Click Delete to proceed
6. Success notification confirms deletion
7. Redirect to routes list

Note: Route deletion does not delete the devices, pipelines, or targets used by the route. Only the routing configuration is removed.

Edit Mode Workflow

Route detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

1. Navigate to editable tab
2. Click the tab's manage button (for example, Manage route details)
3. Form fields become editable
4. Save changes and Cancel buttons appear

Make Changes:

• Modify editable fields
• Update Director selections
• Change scheduling settings
• Changes are not saved automatically

Save Changes:

1. Click Save changes
2. System validates changes
3. Success notification displays confirmation
4. Edit mode exits
5. Tab displays updated values

Cancel Changes:

Clicking Cancel with unsaved modifications opens an Unsaved changes modal with Continue editing (return to the form) and Discard (revert and exit edit mode) buttons.

Notifications

The Routes interface provides automatic notifications for all operations:

Success

Success messages auto-dismiss after 10 seconds. These include confirmations for route creation, enabling, disabling, deletion, and configuration updates. Hover to pause the auto-close timer, or click X to dismiss manually.

Errors

Error notifications persist until manually dismissed. These include failures for enable, disable, delete, update operations, and validation errors. Review error details and take corrective action before dismissing.