I have a question on configuring / deploying the NDR Investigation Console: on the configuration screen I am asked to set a network port (description reads "This network port is used by NDR sensors to communicate with an Investigation Console". I don't remember having set any port number when deploying the NDR sensors themselves, so does anyone know what value to enter here? Does it use some default value that is omitted in the field of the configuration UI? Is there a best practice?
Also, am I correct in assuming that the IP of this console VM should be in the same subnet as the NDR sensors themselves (not the VSPAN, but the management interface)? Or do they just need to be able to reach the NDR sensors?