Hello
I have following Problem, i created an analytic rule which simply queries a log source,
usually this query rule does return multiple lines as a result.
Now i simply want to have one Incident (Incident id) for each of the results returned by the Query.
The Goal would that this Incident can be dispatched to different groups and investigated.
Usually for of each line returned by the Analytic rule a different Team is responsible,
So, I want to have Separate incidents for that.
Could somebody explain me how to do so, I have meanwhile tried all the Possible settings in the Analytic Rule but so far did not found the right way to do so.
KR
Sebastian
