Dear All,

after browsing the documentation I did not find any reference on how to
deal with the EAS database.
According to the documentation of the Reporting Module one should first
install EAS (on one) server and after this has been done (and all
supported sources are configured to connect to the new EAS Server) the
reporting server should be installed on possibly on other server.

Through the EAS installation a new posgresql instance is setup
providing the sentinel db schema. Later though the reporting install an
additional db schema is introduced.

My question is where the retention (dropping and creation of db
partitions) of the SIEM schema is configured.

I know that in the web guy of the reporting sever retention can be
configured but my guess was that this parameter is only affecting the
reporting schema.

can anybody help?



tschloesser's Profile:
View this thread: