About policy mapping in ESM

The check expressions in a standard are mapped with the policies in Enterprise Security Manager. When you execute a data collection job for a standard on ESM assets, the ESM data collector collects messages for the corresponding ESM policy from the ESM manager. Each check expression within a section of a CCS standard is mapped to an ESM policy.

If you create a custom standard, then you must change the name of the ESM policy that corresponds to the CCS standard.

More Information

Configuring ESM policy run options