So,

With a source sending through CEF event data, what should be the Collector? There seems to be no clear documentation.

I've seen instances where eDir will default to Universal, but then sometimes send through eDirectory.

AAF, when configured, seems to default to Imperva SecureSphere...forcing it to Universal, it plops back to Imperva

Code:
Name: NetIQ_Universal-Event
Release: Sep 15, 2014 6:07:50 PM
Version: 2011.1r4-201409150407-release

Name: Imperva_SecureSphere
Release: Nov 18, 2013 10:38:46 PM
Version: 2011.1r1-201311180638-release


Name: NetIQ_eDirectory
Release: Mar 28, 2017 10:35:28 PM
Version: 2011.1r8-201703280735-release