Yes, multiple Concentrators can aggregate metadata from a single
Decoder. Review Concentrator teaming. When Concentrators are teamed no
single Concentrator indexes all the metadata. In rare circumstances it
is possible to NOT team Concentrators and b...
Here are a few by searching for "Integration Guide"
ArcSighthttps://community.rsa.com/docs/DOC-67403
Splunkhttps://community.rsa.com/docs/DOC-61797
LogRhythmhttps://community.rsa.com/docs/DOC-79040
QRadarhttps://community.rsa.com/docs/DOC-79148
Example Packet Decoder Application RuleRule Name :: Low Packet CountRule
Syntax :: packets count l-2 Note :: the above syntax is a lower case el
"L" NOT number one. I recommend viewing all the metadata created from a
typical session you are targeting...