Coalescing of events in XSIAM?

amcdonal363 — Thu, 01 Aug 2024 16:48:07 GMT

Looking to migrate from QRadar/QRoC to XSIAM

In QRadar/QRoC, coalescing works in the following manner:

The goal of coalescing is to reduce the need for storage of events for certain event types which full payload data is not needed.

Is coalescing of events in XSIAM enabled already, possible to enable, or even desirable?

Re: Coalescing of events in XSIAM?

afurze — Thu, 01 Aug 2024 16:54:54 GMT

Amcdonal363,

XSIAM event storage is handled by the system in the backend transparently for customers, there is no need to configure anything like this.