any advice how to avoid mixng values in assets by entitymerge command?
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2
If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset or identity, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.
Upcoming versions have some features that might address your issue.