Showing results for 
Search instead for 
Did you mean: 
Level 7
Report Inappropriate Content
Message 1 of 1

Problem with Correlation manager

Hello Everyone!

I have the following issue, i want to create a Correlation Manager that correlate activity from a Source User and a Destination IP, like this

Configuration ACE.PNG

But when i apply the changes, i review the configuration and i got this

Configuration ACE 2.PNG

Why SIEM reset the configuration to only one field to correlate? and don't even give a warning!

can i correlate 2 fields?