Why is the security log count on the monitoring page different from the count of the extracted report?

If you search security logs from January 10 to January 12 in the monitoring menu of the NGAF management page, approximately 27,000 logs are counted.

However, if you extract a report by setting the same period, up to 3000 graph legends are created and dots are displayed at intervals between 2500 and 3000.

Do you know why the two figures are different when searching the security log and extracting it as a report?

(monitor tap's count total)

(report count total)

Becasue some are redundant events and NGAF correlates logs .

The display total alerts in the NGAF management page is much accurate since it is a correlated logs from the beginning

Do you have Syslog, because it synchronize the data to it that's why is it different

Because some logs are duplicated or events have occured multiple times. NGAF correlates it that is why the counts decreases.

The logs you see on the dashboard are raw so it is to many.