Idea ID: 2872974

Improve parsing for WiNC connector

Kresimir Zamuda Kresimir Zamuda
Status : Declined

Hello,

Unfortunately, the ArcSight Idea Exchange is not the proper forum for this. I realize you have already contacted Support. Please send me the support ticket number and I will look into it.

Thank you,

--
Prentice S. Hayes
Product Management | ArcSight
OpenText Cybersecurity

prentice.hayes2@microfocus.com


See status update history

Can you please update parsing for event ID 4771, to map IpAddress to sourceAddress? The reason for this is that the client address is viewed as a source address from the point of DC.
Currently, it's mapped to dCS3 field (conditionalmap[0].mappings[125].event.deviceCustomString3=IpAddress).
Basically, we would like to have it the same way it's made for event 4768 (as an example), where this information is mapped to sourceAddress: conditionalmap[0].mappings[122].event.sourceAddress=__oneOfAddress(IpAddress)

A support representative recommended submitting an idea on the Idea Exchange portal.

Thank you.

Resources

Support
Documentation
Training
CyberRes Academy
Partner Portal
Contact us
Compliance
Help
Company
Privacy Policy
Terms of Use
Accessibility
Anti-Slavery Statement
Support
How To Buy
Careers
Investor Relations
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.