ES - Threat Activity Search add Host field

[mmoermans]

When matching against threat intel the notable events only shows the source and destination of the matched event. Is there a way to make the correlation search only find specific events with a specific host and show the host in the notable event?

For example, showing the source, destination and that it occured on firewall 2.

[lakshman239 · Accepted solution]

I assume if you use a datamodel (e.g Network_Traffic), you can use the 'dvc' value which should indicate the firewall/host on which the event was noticed.