ArcSight SOAR Case

I use ESM as the Alert Source for SOAR, but the rule in ESM triggers only when the same source Address and URL occur 1000 times within 24 hours, whereas SOAR Case triggers for every single event. Where should I adjust this?

Tags: