McAfee ePO - Source Adress empty but in Device Custom IPv6 Address2 - Parser Override

[Volker Michels]

Hello Community,

I want to deploy a parser override for McAfee ePO to populate IpV4 source address from IPv6 adress.

The IP address is looking like this: ::FFFF:1.2.3.4

1. Parser Location

.../current/user/agent/fcp/epo_db/virusscan4_5_virusscan.sdkibdatabase.properties

2. Parser Regex

event.sourceAddress=__regexToken(sourceipv6,"(?:::ffff:)?(\\d+\\.\\d+\\.\\d+\\.\\d+)")

But this would override everytime, what do I need to use if I want to override the source address only in case it is empty?

Thx, Volker

[Shaun]

event.sourceAddress=__oneOfAddress(__integerToAddressMcAfee(sourceaddress),__numberToAddress(getIPv4AddressEmbeddedInIPv6Address(sourceipv6)))

[Volker Michels]

For some reason it's not taking the parser file, am I doing something wrong with the name?

virusscan4_5_virusscan.sdkibdatabase.properties

[Shaun]

needs to be in:

$AGENT_DIR/current/user/agent/fcp/epo_db/virusscan/4_5_virusscan.sdkibdatabase.properties

you should see it being read from in agent.log

[Volker Michels]

Hello Shaun,

now it reads the parser ovverride:

ContentInputStreamOverrides[0]...............12/21/15 3:27 PM: [/opt/arcsight/connectors/connector_7/current/user/agent/fcp/epo_db/virusscan/4_5_virusscan.sdkibdatabase.properties] augments [epo_db/virusscan/4_5_virusscan.sdkibdatabase.properties] for AUP type [fcp] and ID [3n7UojFEBABDoOUyPFWXxww==]

however the Attacker Address is still empty:

Any idea?

Volker

[Shaun · Accepted solution]

I don't know how the data gets populated into deviceCustomIPv6Address1 (Your screenshot is cutoff so I'll assume 1)

Since we know the data is somehow in there, try using a map file:

map.0.properties

-------------------------

set.expr(deviceCustomIPv6Address1).event.sourceAddress

"__numberToAddress(__getIPv4AddressEmbeddedInIPv6Address(deviceCustomIPv6Address1))"

[Volker Michels]

Hello Shaun,

thanks a lot the worked perfectly.

It was deviceCustomIPv6Address2.

Volker