Hi guys,
I have an issue with the Enterprise Security APP where I try to add a new Event Attributes (user) that is correctly populated and available in the event (in the Contributing Events search) and in the datamodel, but it is not showed in the Incident Review table.
It seems that It can be an error with the alias of the field because in the data raw we see that the field name is "userPrincipalName" but in the Interesting Field we have "user" (the field that is now showed in the Incident Review table).
We also tried adding the userPrincipalName field to the Event Attributes but also this field is not populated.
How can we show that field in the table?
Thanks,
Mauro
