Idea ID 2802650
Currently, event annotation stages are not preserved when forwarding correlated events from one ESM to another. The request is to make it possible to preserve the stages
Reason: customers use the event annotation stage to set the status of a correlated event within use case life cycle, for example, "for investigation", "in staging mode" or "discrete rule, no attention needed". When forwarding correlated events from correlation tier (few ESMs) to central tier (umbrella view, single entry point), the event annotation stage gets reset to "queued" and therefore essential information gets lost.
NGS-11708 was created before
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.