2 Replies Latest reply on Sep 8, 2014 8:56 AM by wwatson8351

    How to assign an ACE to a certain Receiver?

    wwatson8351

      Good afternoon,

       

      I'm fairly new to McAfee SIEM and i have a very infant deployment.  I currently have an ESM, two ACEs and two ERCs (stand alone appliances),  I was planning on having my two receivers act independently and collect specific events from  different locations/etc.  My real question is, besides having one of my ACEs process current events and one process historical events, is there a way to have each one tied to a specific ERC?

        • 1. Re: How to assign an ACE to a certain Receiver?
          Scott Taschler

          There are a couple of options.  If you assign your Receivers to different zones, then you can assign each ACE to a different Zone.  If you open ACE Properties/Correlation Management, you'll see your various Risk correlation managers, as well as your Rules Correlation Engine listed.  Edit your Rules Correlation Engine, and you'll have the option to assign it to a specific Zone.  If you like, you could even have 2 Rules Engines on the same ACE, each doing work for a different zone.

           

          Alternately, if your Receivers are in the same zone, you can use filters to accomplish this as well.  Hit the Filters tab in the Rules Correlation Engine.  You can then create a filter that brings in events only from the one Receiver.  Again, you can apply a different filter to your other ACE, or you could create multiple engines on a single ACE to analyze your different events streams.

           

          9-5-2014 3-33-52 PM.png

           

          Having said all that, I'm not sure all this is necessary.  Is there a reason you'd like to have the ACE analyse your events from the 2 different Receivers separately?  This eliminates your ability to identify issues that might span different sites.  Maybe in your environment it's not likely to matter, but in general there are few downsides to bringing all your events into a single ACE for correlation...this is the common deployment.

           

          Scott

          • 2. Re: How to assign an ACE to a certain Receiver?
            wwatson8351

            Thanks Scott,

             

            I only ask this because we have 2 ACEs, and right now they're doing the exact same thing.  I was thinking about having one correlate historical data and the other current.  I just want to figure out how best to leverage my systems to get the most out of them.

             

            v/r

            Wendell