README.md 1.2 KB
Summary
This module creates HEC load balancers using the previous domain name for for legacy compatibility. It should not be added to new accounts.
Without this, the existing customer AWS data and other things submitting to the HEC could get lost during the migration.
But if activity is low/zero, destroy it!
iratemoses Aliases
Additionally, for MOOSE only, it creates 'iratemoses' aliases.
List of HECs
Permanent:
These are the HECs created by the indexer cluster module, which will stick around:
moose-hec.xdrtest.accenturefederalcyber.com - Non-ack external HEC moose-hec-ack.xdrtest.accenturefederalcyber.com - ACK external HEC moose-hec.pvt.xdrtest.accenturefederalcyber.com - non-ack internal HEC moose-hec-ack.pvt.xdrtest.accenturefederalcyber.com - ACK internal HEC
These are the HECs that are created by the legacy_hec module, which should not be used for any new purposes:
moose-hec.mdr-test.defpoint.com moose-hec-ack.mdr-test.defpoint.com iratemoses.msoc.defpoint.local (moose only) iratemoses.mdr-test.defpoint.com (moose only)
Notably, the following intentionally do not exist:
moose-hec.msoc.defpoint.local moose-hec-ack.msoc.defpoint.local