I got one from a customer in APAC today, by way of their SE.



Can I have a Primary ESM+DAS-50 with Redundant ESM+DAS-100? The intent would be to keep more data on the Redundant ESM.”




No. We require primary and redundant appliances to be exact replicas of each other. This is the supported and recommended way to enable redundancy. Since one is essentially a mirror image of the other, they must both be identical platforms.

Just to highlight how important this requirement is, I will include a quote from one of the SIEM product managers.

" I'm not aware of anyone running in this config, but just the thought of it makes me nervous"