We are facing some issue while creating ticket, For the first run of correlation, notable events are generating and grouping it into Episode, however, Its creating multiple(for each events in the episode) tickets for the episode at the first time, from the second run notables are getting duplicated into the episode, all the new notables are getting updated to the ticket which created with first alert in the episode in the first run of correlation search. Please let us know if it’s known behavior, if yes what is the logic behind it? or any specific setting/fields needs to be modified while raising the tickets raising tickets ?
... View more