I have the following issue, i want to create a Correlation Manager that correlate activity from a Source User and a Destination IP, like this
But when i apply the changes, i review the configuration and i got this
Why SIEM reset the configuration to only one field to correlate? and don't even give a warning!
can i correlate 2 fields?