0 Replies Latest reply on Mar 26, 2015 10:39 AM by layer0

    Problem with Correlation manager

    layer0

      Hello Everyone!

       

      I have the following issue, i want to create a Correlation Manager that correlate activity from a Source User and a Destination IP, like this

       

      Configuration ACE.PNG

       

      But when i apply the changes, i review the configuration and i got this

       

      Configuration ACE 2.PNG

       

      Why SIEM reset the configuration to only one field to correlate? and don't even give a warning!

       

      can i correlate 2 fields?

       

       

      Thanks.