Correlation Event Source Event name on Event Query Summary in Bar Chart

[SpaceUser]

Hi everyone,

I have custom bar charts. "Edit Query" -> event queries and summary is selected. Every bar chart is as expected except 1.

I put signature id of correlation rule as a filter and I want to see how many events happened last week. When I select "summary" in event queries report produces with 1 line "Correlation_Name  X times" in bar chart. But I want to see source events and their count in bar chart. Correlation has different source events.

I want to see Rule Messages in report:

Report Produces Correlation Name:

My bar chart query settings:

How can I get Rule Messages in bar chart?

thanks.

[McAfeeSIEM_Eric · Accepted solution]

SpaceUserReport,

Currently there is not a way to do this I would recommend submitting an idea to see this in future versions.