If they keep coming back after you delete them, it's because new events are coming in with that DetectionIP value from one of your log sources. LEM uses DetectionIP to determine when a host is sending data to another that's picked up by LEM. We'll have to track down what that log source is to see if we can figure out why it's happening. If you double click on that node from Manage>Nodes it should do a quick search for that node's IP anywhere in your data, though if it's been too long you might have to dig farther back in time.
↧
