Users are unable to open Netwitness Support Cases via email. Please open support cases via portal or by phone
I am having a question as I need to know when to apply the basic correlation rules on the Decoders and when to apply them on Concentrators. So, is there as best practice or a certain recommendation?
Thanks in advance
In my opinion, the short answer is neither. All correlations should be performed on ESA - not via the basic correlation rules.
Thank you so much. Noted
We are actually in discussions to remove the correlation rules on the concentrators to minimize the confusion here.
Thanks for this info