IIS 8.5 x-Forwarded-For

[checky04]

Hi,  I'm setting up our IIS 8.5 logs and we added the column X-forwader to get the original source/attacker instead of the web server IP.  I can see this info in our Logger with column name "AD.x-Forwarded-For" but I cannot find this field in the ArcSight Express 4.0 console.   Can you please guide in setting this event?

Thanks and regards,

Richel

[joao.farias]

Hi Richel. You can add a conditional mapping. Go to the ESM console and right click on the connector that is pulling logs from logger. Then Send Command -> Mapping -> Get additional Names. Take notes about the additional fields you want and map them through the same path on "Map additional names".

[checky04 · Accepted solution]

Thanks!   I will try this option during my maintenance and will let you know the outcome.  So far adding this in the ESM sever.properties fix my issue.

"turbo.enabled=false"

[ramkishore1]

is there any other way