ProTip for SIEM: Users see lower event counts or missed events after disabling data source rules

Version 1

    Users may encounter an issue where they see lower than expected event counts in the Enterprise Security manager (ESM) dashboard. This may occur if data source rules are disabled in the ESM Policy Editor. In this case, events will be discarded, resulting in lower than expected event counts.

    For more information on this issue, as well as solutions, see KB86560 (