Our system's Event Viewer has received a handful of "Denied traffic to enVision" events that reference port 2010.
Usually, these events are simple denies from unknown addresses. But, the ones we got state that the source is one or two of my collectors on port 2010, denied trying to talk to the D-SRV on a higher , port, usually 3000 range.
I looked on 6 of my 8 collectors, and all have at least four established 2010 sessions open with the D-SRV.
Does anyone know what these are?