Big news! The community will be moving to a new platform April 21. Read more.
Big news! The community will be moving to a new platform April 21. Read more.
Lieutenant
Lieutenant
593 views

Rename fields of SmartConnector without change categorization

I need to rename the fields deviceVendor and deviceProduct of a Syslog SmartConnector but I created a map.x.properties and a .csv file under current/user/agent/acp/categorizer/current/deviceVendor/deviceProduct.csv the fields changed but the category fields were null.

There are any posibility to change these fields with persist categorization fields?

Thanks

Labels (1)
0 Likes
3 Replies
Lieutenant
Lieutenant

any solution?

0 Likes
Fleet Admiral
Fleet Admiral

I am afraid that categorization is triggered by the deviceEventClassId, deviceProduct and deviceVendor fields specifically. As long as you have data in these fields that matches with the categorization field, you will get categorization applied. Since you are looking to change the mapping of deviceProduct and deviceVendor, I am afraid that categorization wont be applied as a result.

That said though, there are a few things that you cant map with a map override file - and deviceProduct, deviceVendor, attackerAddress and targetAddress are a few of them. The best thing to do is use a parser override (which assumes you have the unobfuscated parser) or to adjust the parser itself (which also assumes you have the unobfuscated parser).

I would recommend that you get in touch with the support team and request access to the unobfuscated parser so you can make a change to it - and adjust the deviceVendor and deviceProduct fields. If you have any issues, please do let me know.

0 Likes
Lieutenant
Lieutenant

Hi,

Finally HP Team gave me a category file with the solution

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.