I would recommend looking on SCOL somewhere...I am not sure where they would put it. Again, it was only a "mention" that I saw somewhere that it was going to be included, but I have not heard anything else.
| Adam Rasnick | Practice Consultant, RSA Professional Services| 423.833.9297| email@example.com | RSA The Security Division of EMC
Event Stream Analysis (ESA) appliance gives you the capability to do correlation and complex event processing (incident alerts). This capability used to be in the Security Analytics Warehouse (SAW). So if you weren't running the SAW in the past you shouldn't have an issue wrt the ESA. If you do currently have a SAW you should open a support case and contact your account rep before upgrading to 10.3 to find out your best options.