I have a All in One ESM. I am following the document "SIEM Foundations:Enable Correlation". When I try to create a Data source on my event Receiver for the McAfee Correlation Engine I receive the following error:
Only one Correlation data source allowed per receiver. (ER273)
I have searched the box and I do not have any other correlation engines running. Has anyone else ran into this issue or know how to correct it?
Hmm, if you do not already have added a Correlation Engine to your receiver I would suggest you contact support.
But before that click on "Receiver Properties -> Data Source -> Write" button and then try again to add your Correlation Engine.
Change your Device view to Device Type.
Scroll down to
If it's there you already defined it.
you can edit it to a more appropriate name there, and also enable disable and remove it as needed.
You likely named something odd and it's berried in the list