On ESM version 10.3.2 the filter field "Context" in the rule on the "Correlation Engine", what does it mean?
How does it mean the Context's values: "internal to external", "internal to internal" and so on... Do they depend on the HOME_NET/EXTERNAL_NET variables in the Policy editor, or is the HOME_NET still configured somewhere in the Asset Manager?
Thank you.
Context is determined by your Local Network setting. Open System Properties, ESM Management and Local Network. This should be configured with your "protected network" and is typically configured the same as HOME_NET.