I have a correlation rule based on different IronPort events with different signature ID's, and I group them with the "Message_ID" field :
In the ace correlation rule, I created a table view which lists me all correlated events :
If I click on the "+" sign on the left of each row, I got all my "source" events (5 for each correlated event) with associated custom types that I'm interested in (Source User, To, File_Name) :
The problem is that when I export all those data from this view, I only get correlated event rows in the CSV file, which does not contains custom types data. The associated "source events" are not exported.
I have the same behavior when I do the same thing with the report section inside system preferences.
Do you have any idea on how to export all data including source users, to and file names (from my 3rd screenshot) ?