topic Security Domain in Security

topic Security Domain in Security https://community.splunk.com/t5/Security/Security-Domain/m-p/692605#M17960 <P>Why is it that every time I set the event under (Security Domain=NETWORK) from the Content Management page, the value (Security Domain=Threat) appears on the Incident Review page even though I set it as NETWORK?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31632i0EFF335FB9AE37E6/image-size/medium?v=v2&px=400" role="button" title="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" alt="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" /></span></P><P> </P> Mon, 08 Jul 2024 08:25:45 GMT tuts 2024-07-08T08:25:45Z Security Domain https://community.splunk.com/t5/Security/Security-Domain/m-p/692605#M17960 <P>Why is it that every time I set the event under (Security Domain=NETWORK) from the Content Management page, the value (Security Domain=Threat) appears on the Incident Review page even though I set it as NETWORK?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31632i0EFF335FB9AE37E6/image-size/medium?v=v2&px=400" role="button" title="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" alt="2024-07-08 10_59_21-Incident Review _ Splunk and 31 more pages - Profile 1 - Microsoft Edge.jpg" /></span></P><P> </P> Mon, 08 Jul 2024 08:25:45 GMT https://community.splunk.com/t5/Security/Security-Domain/m-p/692605#M17960 tuts 2024-07-08T08:25:45Z