Labels

API-SDK-Extensibility
9
APIs
26
ArcMC
117
Big Data
5
Cloud
34
Connectors
437
Content
23
Context Data
10
Deploy & Arch.
27
ESM
262
Investigate
12
Language Support
5
Logger-Search-Reporting
64
MSSP
4
Recon
25
SOAR
33
SODP (ADP)
24
Transformation Hub
40
UEBA-ML-AI-Interset
3
UI-Dashboard-Widget
13
Idea ID: 2872974

Improve parsing for WiNC connector

Kresimir Zamuda
Status: Declined

Hello,

Unfortunately, the ArcSight Idea Exchange is not the proper forum for this. I realize you have already contacted Support. Please send me the support ticket number and I will look into it.

Thank you,

--
Prentice S. Hayes
Product Management | ArcSight
OpenText Cybersecurity

prentice.hayes2@microfocus.com

See status update history

Can you please update parsing for event ID 4771, to map IpAddress to sourceAddress? The reason for this is that the client address is viewed as a source address from the point of DC.
Currently, it's mapped to dCS3 field (conditionalmap[0].mappings[125].event.deviceCustomString3=IpAddress).
Basically, we would like to have it the same way it's made for event 4768 (as an example), where this information is mapped to sourceAddress: conditionalmap[0].mappings[122].event.sourceAddress=__oneOfAddress(IpAddress)

A support representative recommended submitting an idea on the Idea Exchange portal.

Thank you.

Parents Comment Children
No Data

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.