FAQs
- Can AARNet provide guidance on the sizing of the WEC server?
- Do we need to build multiple WEC servers for redundancy purposes?
- Can I set up load balancing between multiple WEC servers?
- How are logs/events collected at the WEC server exported to the AARNet SIEM?
- Which events should we log?
- What happens if the WEC server is not able to communicate with the AARNet SIEM?
- Is there a way to determine the size of the disk based on the number of events seen in our environment?
- What happens to the events collected in the WEC server once they have been exported to the AARNet SIEM?
- What firewall settings are needed for the WEC server and event sources?