Elastic SIEM Network Map Layers Issues


I have been experiencing some issues with Elastic SIEM Network Map Layers. I have configured only indices corporatepfw-ecs-* from which the SIEM app collects events. See the image below.

However, In the SIEM > Network > Map Layers I still see more that on layer of indices, that is corporatepfw-ecs-* and corporatepfw-. In my configurations I have not configured corporatepfw- in SIEM. See the image below.

Kindly assist on how to remove the indices corporatepfw-* in the SIEM > Network > Map Layers. I do not wish to delete the indices corporatepfw-*.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.