EDR Support
EDRs are usage records with support to configure content information, format, and generation of triggers by the system administrative user. The EDRs are generated according to explicit action statements in rule commands. Several EDR schema types, where each schema type includes a series of analyzer parameter names, exist in the EDR. The EDRs are generated in CSV format at the time of each event.
The EDRs are stored in timestamped files that you can download through SFTP from the configured context. The EDRs are generated on per flow basis, and they catch whatever bytes get transmitted over that flow including those retransmitted.