cancel
Showing results for 
Search instead for 
Did you mean: 

ProTip for SIEM: Users see lower event counts or missed events after disabling data source rules

ProTip for SIEM: Users see lower event counts or missed events after disabling data source rules

Users may encounter an issue where they see lower than expected event counts in the Enterprise Security manager (ESM) dashboard. This may occur if data source rules are disabled in the ESM Policy Editor. In this case, events will be discarded, resulting in lower than expected event counts.

For more information on this issue, as well as solutions, see KB86560 (https://kc.mcafee.com/corporate/index?page=content&id=KB86560). 

Version history
Revision #:
1 of 1
Last update:
‎05-31-2016 07:49 AM
Updated by: