IPS Event Summerization
In this section, the requirement is to use the most condensed report after we cross the threshold.
Doesnt that mean we should use global summarize mode for this requirment instead of summarize?
If that is the case, then we need to configure both summary and global summary thresholds. Please correct me if I am wrong.