ESM uses the Local Network setting (also called Homenet in previous ESM versions) to identify IP addresses that are considered to be “inside” your enterprise network. This variable is used in a wide range of correlation rules and other ESM components to differentiate between inbound and outbound traffic. It's important to configure this setting properly in order for rules and other SIEM features to operate properly.
To configure Local Network:
- Open the System Properties
- Select Network Settings and click Local Network -> Setup
- Enter the IP ranges that define your internal network. Local Network is defined as a comma-separated list of IP addresses and/or IP ranges. Click OK to save.