3 Replies Latest reply on Feb 2, 2016 7:36 AM by xded

    Change aggregation attributes

    jp87

      Hi,

      I'm trying to change what fields that must be identical when performing aggregation on events.

      What I did:

      Mark the ESM -> Policy Editor -> Data Source(when you expand receiver) -> Searched for the Signature I wanted to change and marked it -> Operations -> Modify Aggregation Settings -> Changed Field 2(From Dest IP to Command) and then rolled out.

       

      What did I miss?

       

      /JP