I think you can't create new normalized id perhaps you can use Normalized ID: 4160749568 (Description: Indicates activity from a user defined event.) for new category you think that does not come under McAfee defined categories
Thanks for your reply.
That's what I'm doing right now. But like that I am limited to one case.
But I want to have two different cases. Which is not possible with the one user definded normID...
can you describe what exactly you are trying to achieve with new Normalized id?
I want to forward some correlated events.
The different correlation rules are listed in a watchlist.
But at event forwarding i am not able to select that watchlist.
Thats why i am trying to label all those correlation rules(but just them) with the same normID, to filter the forwarding with the normID.
I suggest you to use the default normalized id of the events you are trying to forward(filters are also best if you have specific requirement