Hi,
How to create automatic tag if:
eventtypes.conf
[duo_authentication]
search = sourcetype=json:duo type=authentication
tags.conf
[eventtype=duo_authentication]
authentication = enabled
I also add to admin, user, power roles "default: index=index_of_duo".
But, simply it want add tag (dont understand why if above eventtype search is working)
