add variables into serach name

[riqbal47010]

under correlation search can we add certain variables like $src$ | $dest$ into search name:

actually we are sending these notables to ticketing system through email. the in between machanism automatically opens the ticket for SOC if the email sent to certain email id.

[starcher · Accepted solution]

No. That is what the rule_title is for. Then combine the expand token command. Or construct your own field in the correlation search.