TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Dan, the ratio of Consoles to Event Collectors is many to many, meaning that technically you could have let's say 10 Event Collectors reporting to a Console, or 10 Consoles each communicating with a single Event Collector. There are a few RealSecure 6.0 architecture limitations that you'll need to be aware of: 1. A single Enterprise Database can store event data from a maximum of 5 Event Collectors at any given time. For additional reporting/database scalability beyond this, you could consider using additional databases and then rolling up this data into a single database with ISS' SAFEsuite Decisions. 2. An Event Collector can typically handle up to a maximum of 50 sustained events/sec (no, you won't lose events beyond this, but the system may be forced to throttle back and some events may be delivered late). So you'll want to fashion the number and policies of sensors reporting to each EC so as not to reach this limit. 3. A particular sensor can communicate with only one Event Collector at any given time, though you could change which one on the fly if needed. 4. Consider your hardware carefully... e.g. if you plan on having 5 maxed out Event Collectors talking to a single database, make sure your SQL Server has enough hardware resources to handle 250 transactions/sec! --Jordan ============================= Jordan Blake - [EMAIL PROTECTED] Technical Product Manager Internet Security Systems - The Power to Protect ============================= -----Original Message----- From: Dan Wangler [mailto:[EMAIL PROTECTED]] Sent: Friday, October 05, 2001 11:52 AM To: [EMAIL PROTECTED] Subject: Regional EventCollectors TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- We are in the process of designing our IDS network to monitor our entire network. We are planning to install one or more NIDS and/or HIDS in several regions troughout our company. As such, we want any events reported in one region to be routed to the local NOC in that region to monitor those events as well as sending the events to a main console that is centrally located to our security staff. We would like to set up an Event Collector in each region such that the sensors in the region will report to the local EventCollector and the EC would report the events to a common Enterprise database, as well as consoles located both centrally and in the region. We would guess that the central console would have to be setup to monitor events from multiple EventCollectors in order to be able to do this. Is it possible in RS 6.0 to have one console connected to multiple Event Collectors and EventCollectors reporting to multiple consoles? Secondly, can network and host sensors report to multiple Event Collectors? Thanks Dan Wangler, GIAC Certified Intrusion Analyst IT Security Response Team, Texas Instruments, Inc. Spring Creek Bldg 1, C196, 6500 Chase Oaks, Blvd, MS 8417, Plano, Texas, 85023 Tel #; 214-567-8304; Email:; [EMAIL PROTECTED] Dan Wangler, GIAC Certified Intrusion Analyst IT Security Response Team, Texas Instruments, Inc. Spring Creek Bldg 1, C196, 6500 Chase Oaks, Blvd, MS 8417, Plano, Texas, 85023 Tel #; 214-567-8304; Email:; [EMAIL PROTECTED]
