32.1 Data You Can Migrate

You can migrate event data, raw data, and some of the configuration data. You must manually re-create the rest of the configuration, which cannot be migrated.

Table 32-2 Configurations You Can Migrate and Configurations You Need to Re-Create

Configurations You Can Migrate

Configurations You Need to Re-Create

  • Correlation rules

  • Actions

  • Maps

  • Filters

  • Threat feeds

  • ESM configuration

  • Alerts except for the Knowledge Base data

  • NetFlow

  • Tenants, Roles, Users, and LDAP configuration

  • Event and alert routing rules

  • Data and alert retention policies

  • Dashboards

  • Real-time views

  • Identity information

  • Feeds configuration

  • Action and Integrator plug-in configuration

  • Security configuration