How to make SSIM select assignee based on source ip
Created: 20 May 2014 • Updated: 03 Jun 2014 | 1 comment
This issue has been solved. See solution.
I have a doubt that for rules like internal port sweep where source ip is same and destination ip is different. So it will be better to select assigned user for these incidents based on source ip only.My question is if it is possible in SSIM?