McAfee ePO - Source Adress empty but in Device Custom IPv6 Address2 - Parser Override

Hello Community,

I want to deploy a parser override for McAfee ePO to populate IpV4 source address from IPv6 adress.

The IP address is looking like this: ::FFFF:

1. Parser Location


2. Parser Regex

event.sourceAddress=__regexToken(sourceipv6,"(?:::ffff:)?(\\d \\.\\d \\.\\d \\.\\d )")

But this would override everytime, what do I need to use if I want to override the source address only in case it is empty?

Thx, Volker