Hi, I have installed Sophos on a qotom computer. It comes with 8 nics.
Now - I'm looking a ZyXEL to get a complete 2,5gbe ethernet network in my house, however, their switch lacks span/mirror possibility. I would like to have it since I feed all the data for analysis on a separate computer. Can I let the Sophos be in discover mode and just reuse one of the nics not in use?
Or if someone knows how to send netflow to Alienvault/IBM Qradar that could help the problem actually, since I can use a sharktap and just make a tap if needed between. However then it becomes a shitload of things I need to have going 
or does anyone have any other suggestion?
This thread was automatically locked due to age.