Enable Name Resolution

[mys]

Hello Guyz,

I have a couple of concerns,

In the connectors parameters, there are few parameters related to name resolutions

1. Enable name resolution

2. Name Resolution Host name only

3. Name resolution domain from email.

Please if anyone can clear my doubts if I have mis-understood this,  when the above options are set to YES, connectors what it will do it basically does the resolution for domains seens and for the IP addresses PTR as well.

If I set this to NO, what would I loose ?

I would greatly appreciate if someone could explain more about this parameters.

Thanks,

Moh.

[kzamuda]

Hello Moh,

You can check the bellow PDF presentation which should help you understand this feature:
https://community.softwaregrp.com/dcvta86296/attachments/dcvta86296/arcsight-discussions/35180/2/Arcsight%20Connector%20Name%20Resolver%20101%20-%20Mike%20Weston.pdf

I would also recommend checking the bellow two discussions, especially the first one where there is a good explanation on this:
https://community.microfocus.com/t5/ArcSight-User-Discussions/Huge-DNS-traffic-from-ArcSight/td-p/1518373

https://community.microfocus.com/t5/ArcSight-User-Discussions/DNS-Resolution-on-the-Connector/td-p/2690784

In case you still have some unanswered questions, feel free to ask and I will try to clarify it.

Regards,
Kresimir