Regresar
-
Título
Can Change Auditor forward events to a SIEM appliance using UDP? -
Descripción
In a firewalled environment which only allowed UDP connections to the SIEM appliance, is it possible for Change Auditor to use UDP instead of TCP for the SIEM subscription?
-
Causa
This is due to how the SIEM subscription model is implemented, it is important for CA to understand that the previously sent batch of events has been received before queuing up another batch to send. -
Resolución
There is no workaround for this issue, it is only possible for CA to forward events via the subscription using the TCP protocol.