cancel
Showing results for 
Search instead for 
Did you mean: 
cly
Level 7

What is the performance downside of indexing all ports?

The McAfee SIEM is configured, by default, to index only ports 1-1024.  Non-indexed ports do not show in searches.  McAfee best practice is to enable indexing for all ports. 

What is the downside of enabling indexing for all ports?

0 Kudos
2 Replies
Peacekeeper
Level 20

Re: What is the performance downside of indexing all ports?

Moved to SIEM forum there is a better chance of an answer there

0 Kudos
sssyyy
Level 12

Re: What is the performance downside of indexing all ports?

From memory, it will negatively impact the receiver. Why don't you enable as you go?

0 Kudos