Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.
If one has a coalasced event with event count of e.g. 687, is it 687 or 1 event that is counted against the license?
Hello Stefan,
The coalescing function is called after the license count, so coalescing does not give back license as in case with routing rules for dropping events.
More Details - https://www.ibm.com/support/pages/qradar-license-eps-rates-and-giveback
Thanks!
Ashish