We tried to make event definition and wrote this points:
- in Filter&Aggregation>Aggregation used 3 fields (src_address, dst_address, protocol)
- making Fields src_address, dst_address, protocol
and it does no alerts at all…
when we leave only 1 field - it works
more then 1 -no alert and no fields
when we leave 1 field and 3 fields - we get 1 alert and 1 field in notifications
who can help or explain how it works?