+3Hello team,
Is it possible to use UDM filters to filter the events that triggered a rule?
In QRadar, you can apply this type of filter to determine which event actually triggered the rule, and I’d like to know if SecOps has the same search mechanism, since we use this data to create a report.
Regards,
Renato Ferreira
+13Hi
Is the info in this section what you’re looking for?
You can pull similar information using the detection queries in the SIEM search, e.g.
detection.detection.alert_state = "ALERTING"The detection.detection fields do have quite a lot of information that you can extract based on your specific use cases:
+18detection.detection.rule_name = "your rule name”
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
