You want to send events to be correlated from one SSIM server to another SSIM Server without using Service Provider mode.
There is no option to only send incidents, what you need to do is send all the events again to be correlated again. This setup is generally used when you only have 2 appliances:
one collecting/archiving and the other correlating only
one correlating/archive/collection and one as a backup correlating only. (archive being written to external storage.)
If you are not using Service provider mode, the following needs to be done to do send events to be correlated again as incident from one SSIM Server to another:
Go to System tile -> Appliance Configurations Expand the SSIM Server you want to forward incidents from. Go to Event Forwarding Rules -> Create a new Event Forwarding rule. In the new rule properties, enter the following: · Rule Name · The hostname or IP address of the SSIM server the incidents will be sent to · Select the service to forward to, use ‘Correlation Service’, which uses port 10010.