I got one from a customer in APAC today, by way of their SE.


Question:

 

Can I have a Primary ESM+DAS-50 with Redundant ESM+DAS-100? The intent would be to keep more data on the Redundant ESM.”

 

Answer:

 

No. We require primary and redundant appliances to be exact replicas of each other. This is the supported and recommended way to enable redundancy. Since one is essentially a mirror image of the other, they must both be identical platforms.


Just to highlight how important this requirement is, I will include a quote from one of the SIEM product managers.


" I'm not aware of anyone running in this config, but just the thought of it makes me nervous"