I want to deploy a parser override for McAfee ePO to populate IpV4 source address from IPv6 adress.
The IP address is looking like this: ::FFFF:126.96.36.199
1. Parser Location
2. Parser Regex
event.sourceAddress=__regexToken(sourceipv6,"(?:::ffff:)?(\\d \\.\\d \\.\\d \\.\\d )")
But this would override everytime, what do I need to use if I want to override the source address only in case it is empty?