Hi,
I believe there is an event enrichment policy cached somewhere in my test implementation of SOI.
When I look in Event Policy I only see the policy I created today to enrich some alerts. However I see in the console that some alerts are being enriched from a very old policy I was experimenting with but no longer see in the console. I have a feeling the policy exist somewhere on the connector itself as the SA Manager, OneClick are all freshly built. The connectors and the DB however have been reused from the old implementation.
So my question is where is the event policy stored?
Many thanks,
Simon