$ 0 0 OK, so here's what I have to modify Correlation. I assume you modified the previous screen so that it was 10 events within 10 seconds; I added the DestinationPort field (set to Distinct)...