Hi to whomever find this
The incident management review settings has repeated events
What I did?
I purpose logged in with the wrong information to some device, but I only did it once. Howver, the result shown below is generated twice in the Incident Management Review
My settings for this correlation search
Also, the things I have specified, such as:
were not shown whenever the event is generated
Result
Settings