I would like some advise regarding how to better use a USM All-In-One serer + a remote sensor (2 different physical locations, Data Center A and Data Center B)
Right now i have the USM server in DCA and the remote sensor in DCB. I have two contexts/entities respectively and each server/sensor is assigned to receive logs, syslogs and netflow from their respective local assets.
This works well to make sure that assets only talk to their respective local sensor, but i found a few limitations like the one in this FEATURE REQUEST.
I'm thinking of merging my contexts into a single context but after doing so, I would like to continue making sure assets only talk to their local sensor.