Highlighted
scott.conlon@hp Absent Member.
Absent Member.
593 views

Zone information not populating correctly

Jump to solution

Hi,

I've imported Zone information for my environment. It is located under the resource "Site Zones".

Unfortunately zone information is still being tagged by the details under the "ArcSight System" resource. See attachment.zone information.JPG

How do I get it to refer to my zones under Site Zones, rather than ArcSight System?

Thanks

Labels (1)
0 Likes
1 Solution

Accepted Solutions
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

You need to make sure you have your zones linked to a Network and the Network linked to a Customer and the Customer and the Networks applied to the connector receiving the events. See this -> thread

View solution in original post

0 Likes
12 Replies
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

You need to make sure you have your zones linked to a Network and the Network linked to a Customer and the Customer and the Networks applied to the connector receiving the events. See this -> thread

View solution in original post

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

Thanks Richard.

I've followed those steps. I'll test soon.

From my screenshot above, will it matter that the "ArcSight System" folder is above the "Site Zones" folder?

I read you mention something about Zone being assigned by a top-down approach, will it look in that folder firat because it's "higher" in the tree?

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

That was an error on my part, Networks are applied from top down, not Zones, Zones must not overlap

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

Ok, should I delete the default zones?

They make all my zone overlap, they cover almost all IPs in my zones.

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

No, leave the defaults intact

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

Ok, so I am a little confused. The RFC1918 entry of 10.0.0.0-10.255.255.255 is being tagged on all my events.

Basically all my zones fall in this range, but all my events are picking up the RFC1918 first.

I've done all the other steps.

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

Thanks for the replies by the way

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

Sorry, they just can't overlap within a network.  So you add your zones to your network and leave the RFC 1918 (default) intact as a catch all below your Network when attaching to the connector which helps identify unmodelled zones

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

Ok, the catch all's are in the network "Global"

My zones are in the network for my organization.

Should I move the catch alls out of global?

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Zone information not populating correctly

Jump to solution

My device zones are working now.

Maybe took some time to filter through. Ill keep an eye on it.

thanks Richard!

0 Likes
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Zone information not populating correctly

Jump to solution

No problem, best practice is just to leave all the default zones and networks alone and add your ones higher in the list when adding to the connector

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.