Why is the security log count on the monitoring page different from the count of the extracted report?

If you search security logs from January 10 to January 12 in the monitoring menu of the NGAF management page, approximately 27,000 logs are counted.

However, if you extract a report by setting the same period, up to 3000 graph legends are created and dots are displayed at intervals between 2500 and 3000.

Do you know why the two figures are different when searching the security log and extracting it as a report?

(monitor tap's count total)

(report count total)

The logs you see on the dashboard are raw so it is to many.

Do you have Syslog, because it synchronize the data to it that's why is it different

The display total alerts in the NGAF management page is much accurate since it is a correlated logs from the beginning

Becasue some are redundant events and NGAF correlates logs .