0 Replies Latest reply on Mar 26, 2015 10:39 AM by layer0

    Problem with Correlation manager


      Hello Everyone!


      I have the following issue, i want to create a Correlation Manager that correlate activity from a Source User and a Destination IP, like this


      Configuration ACE.PNG


      But when i apply the changes, i review the configuration and i got this


      Configuration ACE 2.PNG


      Why SIEM reset the configuration to only one field to correlate? and don't even give a warning!


      can i correlate 2 fields?