If you don't recieved any logs from the IP address x.x.x.x in over 720 minute(s) this could be
an indication that the system is down and the following event will trigger:
TYPE = SYSLOG
"Client stopped sending logs"
You can also set a tripwire on this event and receive a SMS or email when this trips in the future by pressing the 'Save Filter' button and naming the query and choosing to send an event or SMS.