cancel
Showing results for 
Search instead for 
Did you mean: 

What is the "Details Manager" in the Correlation Engine?

Hello all,

I am attempting to troubleshoot time delta issues with our correlation engine.  I've collected the output of the '/user/local/ace/bin/correlator.sh -status' command and I'm looking at the number of active instances for each rule. 

There's another section for the active instances of the "Details Manager."  In a few instances, this lists active instances for rules that are disabled.  For instance:

                <status name="Ruleset: Details Manager-47-4000126" tag="47-4000126">
                    <property name="activeInstances">
                        <value>375</value>

What is this, and how is it different from the Correlation Engine?

Any information is appreciated!

Thanks,

- Steve

 

 

Tags (2)
More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support

    • Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center