I have the same problem, I would not open multiple events incident on
the same and I can not measure the solution time of the incident.
Example: a server application with a problem of the correlation is
increasingly open fire incident and analysts attending the same event in
separate incidents, and no time to configure a solution to the
correlation time. There will be a way to add events equal to the same
incident or not to open a new incident of the same event?

thank you very much

soporte_securenet's Profile: http://forums.novell.com/member.php?userid=27357
View this thread: http://forums.novell.com/showthread.php?t=438612