continuous scan configuration

[JeffFulford]

In the Continuous Scan Configuration (Malware Analysis config)  what is the Source Host and Source Port config value.  Is the Host the SA or the conentrator? Can the port be any port or does it need to be 56003?

Any help would be much appreciated.

Jeff

[MichaelSconzo]

The documentation leaves a bit to be desired, but it should be the concentrator/broker. We also have a course that goes over configuration.

[JeffFulford]

Thanks Michael, as a follow up question, I am also unclear as to what Malware Analysis service I should be configuring for the continuous scan, the one on the dedicated  Malware Analysis appliance or the SA-Malware Analysis?

Thanks

Jeff

[KEVINDIENST]

If you have a dedicated Malware Analysis device, use that. The out of the box SA - Malware Analysis service running on the SA head is much smaller and limited malware analysis component.