• Support
  • Forums
  • Blogs
A New Community Experience is Coming! For more information, please see our announcement.

Correlation Directives need more customization options for USERNAME and USERDATA fields


Little green alien
It would make the correlation rules customization very powerful if AV allowed to add more than one value (or even a list) and/or wildcards to USERNAME, USERDATA1, USERDATA2, etc. fields same way it allows to add multiple sources/destinations, multiple DataSource IDs or Multiple Sensors, etc.


Share post:


Sign In or Register to comment.