Hello
I am using the below parameter to display MANDIANT_ACTIVE_BREACH_IOC data:
graph.metadata.vendor_name = "MANDIANT_ACTIVE_BREACH_IOC"
However, when I run this query in the SIEM search under the Investigation tab, it returns zero results.
At the same time, under the IOC Alerts and Data tabs, I can see that events are matching against the MANDIANT_ACTIVE_BREACH_IOC feed, which confirms that the data is being ingested and matched correctly.
Could you please help me understand why the search is returning zero results specifically for this feed?
