4 Replies Latest reply on Apr 13, 2016 7:27 AM by yassinezeroual

    Change default aggregation Settings in authentication events


      The default aggregation Settings is: (Source IP, Destination IP, Signature ID)


      In case of the authentication events the default aggregation settings looses the required details needed for compliance monitoring of a username or what a security analyst would need to investigate an incident.

      In the new version 9.6, I hope that McAfee change the default aggregation settings exclusively for the authentication events to be (Username, Source IP, Signature ID).