Hello
Thanks a lot for answering!
Unfortunately the searchs you gave me don't work, looks like the results are both eventtypes cisco_firewall and (cisco_fw_dmz or cisco_fw_inside) so eliminating the common eventtype returns 0 results.
I need the results to be classified as cisco_firewall for the default dashboards that come with Cisco Security Application to work, so supressing this type is not acceptable (unless there is a workaround, like redefining the cisco_firewall eventtype as the sum of the other two).
... View more