Correlation Engine

[uzanatta]

Hi,

the filter field "Contex" in the rule on the "Correlation Engine", what does it mean? How does it mean the Context's values: "internal to external", "internal to internal" and so on... They depend on the HOME_NET/EXTERNAL_NET variables?

Thank you.

Rgds,

[staschler]

Yes, "context" depends on the Homenet configuration, however, not the one in the Policy Editor. 

There are 2 places to configure "home net".  There is a variable in the policy editor, which is used by legacy Nitro IPS rules, and can be safely ignored by most customers.  The "real" Homenet is found under Asset Manager -> Network Discovery -> Homenet.

Any IP addresses that fall into ranges specified here are considered "internal".   This is used to drive the context as seen in many correlation rules. 

Scott 

[uzanatta]

Hi Scott,

thank you.

Rgds,

[jp87]

Hi Scott,

has this been changed in more recent versions(e.g 9.5.0)? I can't see the Homenet under the search path thar you mentioned? Is the new path Asset Manager -> Network Discovery -> Local network?

/JP

[staschler]

Yes, "Homenet" was renamed "Local Networks" a couple versions back, to eliminate the confusion between the two different ones.

Scott

[minsktractorwor]

Hi Scott,

If running the ESM with multiple separate customers, each having different local networks, is it possible to still use "context" within correlation rules?

Cheers

[staschler]

With the existing pre-built rules, no.  In a service provider environment like you're describing, it would be more common to set up separate context variables for each customer, and implement unique rules (typically on separate correlation engines) for each customer referencing the relevant variables, watchlists, etc.

Scott