- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mmoermans
Path Finder
01-04-2019
05:56 AM
When matching against threat intel the notable events only shows the source and destination of the matched event. Is there a way to make the correlation search only find specific events with a specific host and show the host in the notable event?
For example, showing the source, destination and that it occured on firewall 2.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

lakshman239
Influencer
01-09-2019
08:24 AM
I assume if you use a datamodel (e.g Network_Traffic), you can use the 'dvc' value which should indicate the firewall/host on which the event was noticed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

lakshman239
Influencer
01-09-2019
08:24 AM
I assume if you use a datamodel (e.g Network_Traffic), you can use the 'dvc' value which should indicate the firewall/host on which the event was noticed.
