Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Forwarding incidents to master SP, same domain?

Updated: 21 May 2010 | 3 comments
novadean's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

I noticed that the Service Provider model only allows you to forward to a master SP from unique domains.  Meaning, that you cannot forward incidents if the correlation machines are all under the same domain.  

I have two correlation appliances in my environment under the same domain.   Is there any other way to forward incidents from multiple appliances to a SSIM that are all under the same domain?  

Thanks!

discussion Filed Under:

Comments

Laurent_c's picture
26
Oct
2009
0 Votes 0
Login to vote

There are only 2 ways to

There are only 2 ways to forward incidents:

Normal incident forwarding : http://service1.symantec.com/support/ent-gate.nsf/...

And SP model incident forwarding : http://service1.symantec.com/support/ent-gate.nsf/...

novadean's picture
26
Oct
2009
0 Votes 0
Login to vote

 Awesome - I only knew of the

 Awesome - I only knew of the second way (SP model incident forwarding).  Very good to know the normal incident forwarding method.

Thanks!

novadean's picture
27
Oct
2009
0 Votes 0
Login to vote

 It should be noted in the

 It should be noted in the normal incident forwarding KB that it is re-forwarding the events.  I was under the impression that it would be forwarding already created incidents.  However, in this situation it re-forwards the events to be re-correlated.  

Dean