Custome alert name

[oliverhavrila]

Dear SO,

great product, I really like it. I changed 'standalone' architecture to 'distributed' architecture and I am thinking about..

Is possible in every forwarded node set up custom name before rule.name? For example if I have 5 offices I would like to see, from which offices that alert comes: for example

Thank you

[dougburks]

Have you tried clicking the drop-down box and selecting the second query to group by sensor?

For further information, please see:
https://docs.securityonion.net/en/2.3/alerts.html#query-bar