Hi, Another strange thing that happens to me and i just realized is that when i refresh the page "incident Review" with correctly loaded filters and showing true notable results, the filter "source" becomes something like this: source: Access%20-%20Excessive%20Failed%20Logins%20-%20Rule And no results are shown on the page after page refresh. thanks. ... View more

Hi Giuseppe, I did exactly what you said. but no luck! In another try, I even created a search and saved it as an alert, named it "rule-4444" then added a notable to it as an action. it appeared as "rule-4444" in the "Top Notable Events" in the Security Posture page. but when i click on it, it is redirected to incident review page but again all incidents listed. the same thing as ravida says happening. when u first click on it, you can see the notable name in the URL after (incident review page )"/incident_review?form.rule_name=rule-4444" followed by earliest/latest timestamps but after a while when the page load completes it disappears and is replaced with a new URL which only has the earliest/latest values ... View more

Hi  dear Giuseppe, when i clone a rule, Adaptive Response Actions  options (i.e. Notable) and most of the times, Risk Analysis are present by default as are other fields and options the same as the original rule. that's why i clone a rule. second, i used to do so for a long time but never had come up with this problem. and as you mentioned earlier my custom rules were working just fine. about the app, i used my custom app and "SA-AccessProtection" was my last try. And for newly created custom app i do create notable. thanks ... View more

Hi dear Giuseppe, thanks for fast reply. here is what i did. I click on Configure menu, then go on to Content/Content Management. From filers I select and check Correlation Search from the drop-down list. then from "Actions" on the top right corner i hit "Clone". in the new window there are "New Search Label" which i add "- custom"  to the end of it. then i select the App and put it on "SA-AccessProtection". next in "Edit Correlation Search " i  will make any change to the "Search" and click save. Done! this is all i do. The point is even if i enable both of them, the two will appear in the "Top Notable Events" pane and both are working simultaneously. clicking on the original rule redirects u to the "Incident Review" page with the correct rule selected as source. but when clicking on the cloned or newly created rule you'll be redirected to the "Incident Review" page with all incidents listed and source field has no selected value. the strange part is that rules that i had created or cloned in the past (about ) are working fine. ... View more

Hi there, the same story is true for me. Actually after updating ESCU to 4330. Not only for custom correlation search rules but for cloned rules. before that everything was ok! when u clone a built-in rule e.g "Excessive Failed Logins" to something like "Excessive Failed Logins- Custom", in Security Posture's Top Notable Events dashboard pane it appears like "Access - Excessive Failed Logins- Custom - Rule" and when u click on it to open in incident review, it doesn't filter out this as selected source but all incidents are listed as if no filter is selected. ... View more