On ESM version 10.3.2 the filter field "Context" in the rule on the "Correlation Engine", what does it mean?
How does it mean the Context's values: "internal to external", "internal to internal" and so on... Do they depend on the HOME_NET/EXTERNAL_NET variables in the Policy editor, or is the HOME_NET still configured somewhere in the Asset Manager?
Context is determined by your Local Network setting. Open System Properties, ESM Management and Local Network. This should be configured with your "protected network" and is typically configured the same as HOME_NET.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.