Not sure I am missing something, but the Correlation Searches provided by ESCU are not consistent in their results. Some result is the user being indentified as in a field user_id, some in a field UserID
This is inconsistent (which I could live with), but does not match up to the fields used (by default) to identify users within Enterprise Security - Incident Review. So I need to add them to the "Incident Review - Event Attributes".
In addition, if I am using Data Enrichment, then I also need to add to "Incident Review - Event Attributes" fields like UserID_email, UserID_bunit, UserID_category, etc....
If the ESCU could have their correlation search return a more "standard" set of fields as results, then it would make things work more "out of the box"
I appreciate that I might have missed something obvious, I and I hope I have - I value all replies
