Is there a repository of ECAT IIOCs developed by RSA or the community? I
see IIOCs referenced in RSA blog posts that are not part of the default
setup. I have looked on SCOL and here in the community pages, but I have
yet to find anything.
Has anyone started pulling in Netflow data into SA? If so, are you able
to see the "direction" meta and run the RSA provided Netflow reports? I
am unable to do either properly. I added a custom line in my log
concentrator index-concentrator-custom.xm...
Would it be possible to have the raw packet capture from a decoder
copied to another file system or host? We are trying to limit the number
of devices residing in a secure environment, but we want to be able to
process the same traffic on multiple sy...
Thanks for the reply!Any idea how much this will impact the decoder(s)?
I would imagine the busier the decoder the more stress this will add,
but how much?
