Event Subtype - I have looked everywhere trying to understand HOW "event subtype" works.
What is enabled vs disabled
Why would I select any of the other options?
If an event subtype shows "block" when I look at a firewall block event does it mean if on the "Data Source" I can override the subtype with one of the options above?
Retrieving data ...