McAfee ePO - Source Adress empty but in Device Custom IPv6 Address2 - Parser Override

Hello Community,

I want to deploy a parser override for McAfee ePO to populate IpV4 source address from IPv6 adress.

The IP address is looking like this: ::FFFF:1.2.3.4

1. Parser Location

.../current/user/agent/fcp/epo_db/virusscan4_5_virusscan.sdkibdatabase.properties

2. Parser Regex

event.sourceAddress=__regexToken(sourceipv6,"(?:::ffff:)?(\\d \\.\\d \\.\\d \\.\\d )")

But this would override everytime, what do I need to use if I want to override the source address only in case it is empty?

Thx, Volker