If anyone could explain how to utilised the Local ELM machines to create a storage pools. In the ELM add Storage pool options says
"Add a storage pool to hold data. Pools can be made of both local or network storage devices."
But it NOT allowed to add any storeage pools, first need to create a Data Storage. ELM not give option to setup storage locally.
So what's the point of having ELM with redundant , cannot use the machine it self as keep storage pools.
Storage pools typically consist of external storage, such as an iSCSI volume, SAN volume, or DAS device if you have one, connected to the ELM.
Once you have connected one of these storage devices to the ELM, you can define them to be used for storage pools. For example, we use SAN volumes. We have a QLogic fiber card installed in our ESM that connects to our SAN fabric. There are two SAN volumes presented to the SIEM, both of which show up in our Storage Devices tab in the Receiver properties screen.
Once each volume is formatted, a one time operation, the volumes will appear in the Storage Pools tab in the Receiver properties screen.
At that point you can create storage pools of pretty much any size and number to fill the available space. Do be aware that by default, the SIEM will want to used 500Gb of one volume for the management database. This cannot be resized or moved once created.