Application Delivery Management
Application Modernization & Connectivity
CyberRes by OpenText
IT Operations Management
Unfortunately, the ArcSight Idea Exchange is not the proper forum for this. I realize you have already contacted Support. Please send me the support ticket number and I will look into it.
Prentice S. Hayes
Product Management | ArcSight
Can you please update parsing for event ID 4771, to map IpAddress to sourceAddress? The reason for this is that the client address is viewed as a source address from the point of DC.
Currently, it's mapped to dCS3 field (conditionalmap.mappings.event.deviceCustomString3=IpAddress).
Basically, we would like to have it the same way it's made for event 4768 (as an example), where this information is mapped to sourceAddress: conditionalmap.mappings.event.sourceAddress=__oneOfAddress(IpAddress)
A support representative recommended submitting an idea on the Idea Exchange portal.