I am using 2 SIEM, USM and Ossim. i have backed up file event from USM and i restored file backup to OSSIM. but i found the total event is different with original event. For example :
event sshd in original SIEM(USM) total : 80.428 event, but in backup file SIEM (OSSIM) total event :56.919.
logicaly it must be same.
and my question, why it have difference between total in original siem (USM) and total in backup siem (OSSIM) ?
pic . original event
pic. backup event