What happens to the events collected in the WEC server once they have been exported to the AARNet SIEM? June 20, 2023 05:04 Updated If you’ve configured the WEC server correctly, it will overwrite events when it reaches its disk allocation limit. Related articles What firewall settings are needed for the WEC server and event sources? How are logs/events collected at the WEC server exported to the AARNet SIEM? WEC Server Introduction About Winlogbeat