I'm new here so please understand if my question is little bit maladroit.
We have both ESM and ERC with HA configuration and planning to move those server to ESX server as combo box.
So Is that possible to configure SIEM combo box on ESX with HA?
I tried to find it on install guide but couldn't find so If it is possible, please give me some tip or manual where to find.
Thanks a lot in advance.
Unfortunately no. You cannot set up ESM redundancy between two combo boxes, same applies to the ERC component (HA in this case can only be achieved between two physical ERC's), and if you also have a combo running the ELM component, you cannot have ELM redundancy between to combo ELM's either.
I have 4 questions:
1. Do we have any option to put ESM, ERC or ELM in Active-Active HA mode or all of them can be configured only in Active-Standby mode ?
2. Can virtual ESM or ELM be configured in HA ?
3. Can we achieve HA in ACE if configured both in same mode (Real-time/ Historical)
4. Can we achieve HA of two virtual ACE ?
Huge apologies to the delay in replying, didn't get a notification for some reason and have been busy out on projects. Answers to your questions below!
1. Do we have any option to put ESM, ERC or ELM in Active-Active HA mode or all of them can be configured only in Active-Standby mode ? They are all Active-Standby, the ERC (Physical only and configured as a HA Pair) will failover as it's a true HA, the ESM and ELM require manual faliover
2. Can virtual ESM or ELM be configured in HA ? You can have a Primary/Redundant model for both on a VM platform, they don't need to be pyhsical appliances
3. Can we achieve HA in ACE if configured both in same mode (Real-time/ Historical) ACE doesn't really have any kind of HA capabililty (Physical or Virtual (in answer to your next question also)). You have a real time ACE and you can have a Historical ACE, now, that's not to say if the Real-time ACE failed you couldn't recover settings to the Historical and make that a Real-time, I've never had to do this, but a seperate Historical ACE is acceptable for use as a 'backup' ACE if needed.
4. Can we achieve HA of two virtual ACE ? See answer above