0 Replies Latest reply on Aug 20, 2014 7:52 PM by mjs370

    Dashboard False Positive Tuning

    mjs370

      My objective is to tune a dashboard that I have created for certain false positive conditions so the events are no longer visible from the view.  For example when using the Normalized Dashboard I want to add a filter to drop events from a certain ip address such as 10.10.10.1 when the destination port is tcp 80.  I can easily add a filter for each of the individual conditions to filter out all events from 10.10.10.1 or port 80, but I am not sure how to filter them out when the combination occurs.  Does anybody know if this is possible?

       

      Thanks.