Absent Member.
Absent Member.
336 views

Connector Appliance-SmartConnector Runtime Filters

I'm new to Arcsight and I'm trying to setup a Filter Out option on my Connector appliance. I would like to filter out an IP address on my connector but I'm having a hard time determining the correct syntax.

I created a Netflow connector on my connector appliance and I wanted to reduce the number of events being passed to my Logger.  I've gone into the connector Runtime Parameters and I've added, destinationAddress EQ <IP Address>,to the Filter Out option.  I'm using "EQ" because the SmartConnector User Guide said that was the parameter to use.  When I tried that nothing happened.  When I changed the filter to destinationAddress = <IP Address> all  flows stopped.

What is the proper syntax for this filter?

Also, is it necessary to reboot the connector appliance in order to have these filters enforced?

Thanks

Labels (4)
0 Likes
0 Replies
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.