Hi @Sultan77 , if you have ES 7.x, you have to flag all the events and add to the same investigation. I haven't an ES 8.x to guide you  in this case. Ciao. Giuseppe ... View more

Hi @Sultan77 , if you want to open in drilldown only the events related to the results of the correlation search, you have to insert in the drilldown search a subsearch containing the correlation search. in other words, if your correlation search lists some hosts, you should use a drilldown search like the following: <the_same_search_conditions_of_the_correlation_search> [ search <the_full_correlation_search> | fields host ] Ciao. Giuseppe ... View more

Hi @Sultan77 , sorry, what do you mean with correlation with it? Ciao. Giuseppe ... View more