Correlated Event Log Fields Lacking

Reply
Highlighted
L1 Bithead

Correlated Event Log Fields Lacking

Is it me or is there no way to include the actual URL that was accessed by a network source in a "Correlation Log" event (v9.0.9 firmware) . From what I can tell on, other than a generic message like "Host visited known malware URL (X times)". It would be great to know "what" was accessed in the same event so that information can be made available easily in a SIEM vs. having to yet again correlate what the PA's saw a second time within our SIEM. Even if they added an ID field of some kind to associate the correlated event alert with the events it saw, that would make it easier to associate the events with the Correlated Event alert in a SIEM.

Highlighted
Community Team Member

Hi @entangledion ,

 

If there a missing feature then I'd recommend reaching out to your local sales rep and have him create a feature request for you or have your vote added to an existing one (I wasn't able to find an existing one for this specific request though).

 

Cheers !

-Kiwi.

 
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!