Replica trackers¶
A replica tracker mirrors an entity set from a remote TrackMe instance into the local tenant — the pattern for a single central search head reporting across many environments that each run their own TrackMe.
Note
This is one of the two advanced tracker types. To build a tracker from your own SPL (local or remote) rather than mirror another TrackMe, see Hybrid trackers.
What is replicated¶
Per-entity runtime data only — state, score, priority, SLA, tags, timestamps — not configuration. Thresholds and policies stay on the source, and replication is one-way.
How it behaves¶
Replicated entities carry the same state, score, and anomaly reason as on the source; the local decision maker does not re-evaluate them, and the UI marks them as replicated. A global executor refreshes them every few minutes, so they are as fresh as the last run.
Setup¶
A wizard drives it — pick the source remote account, the source tenant and component, and a target prefix, preview the entity count, and create.
Note
Replicated entities count against the target tenant’s license entity count.
Avoid cascading replication (A → B → C) — prefer a flat spokes-to-hub model — and keep source and target TrackMe versions aligned.
See also
Hybrid trackers — the other advanced tracker type: build a signal from your own SPL.
Integrations & Remote Deployments — the remote accounts replica trackers rely on.
Monitoring Components — replicated entities land in the same components as native ones.