We have a device that McAfee ACE with VM12 resources and also using the VM12 combobox too.
I've added the Correlation Engine as a datasource to the receiver on the combobox vm.
I'm checking the events both of the engines that ACE and Correlation Engines' but i can't see the events on the ACE by last 3 hours. I've checked the system logs and there are "Correlation data sent" every 8-9 minutes (i guess that a correlated event occurs every 5 minutes)
But i can see the events normally on the Correlation Engine that which is running on receiver.
Where should i check for this issue?
Do you have any suggestions?
Do you add a Correlation engine as a Datasource on your Receiver or as a Datascource on your ESM? After you create a Correlation engine you need to rollout all Correlation rules on the Correlation engine.