Is it me or is there no way to include the actual URL that was accessed by a network source in a "Correlation Log" event (v9.0.9 firmware) . From what I can tell on, other than a generic message like "Host visited known malware URL (X times)". It would be great to know "what" was accessed in the same event so that information can be made available easily in a SIEM vs. having to yet again correlate what the PA's saw a second time within our SIEM. Even if they added an ID field of some kind to associate the correlated event alert with the events it saw, that would make it easier to associate the events with the Correlated Event alert in a SIEM.
Hi @entangledion ,
If there a missing feature then I'd recommend reaching out to your local sales rep and have him create a feature request for you or have your vote added to an existing one (I wasn't able to find an existing one for this specific request though).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!