one connector multiple customer
I am getting logs from multiple customer on single connector ,
Now i was to differentiate those logs using the customer name field.
As per quide there are 2 option to do so :
Velocity template variable & connector map file
can some share some example of velocity template and connector map file, so that i can implement this.
-> Page 21 Velocity Template:
-> Page 23 Map Files
Have you already tried those?
All the best,
Thank you for your reply.
I haven't tried those yet.
first i want to know how its work :
as per the above syntax if the device hostname end with the customer then only customer name will be tagged to that events.
but i want to segregate customer on the basis of subnet (IP range), then what will be syntax ?
For the time being I was not able to find a Velocity function dealing with IP Addresses.
However, you could use String functions on Address ArcSight Fields. I agree it is more complex, but it can be done nevertheless. For example I have successfully tested the following in the Customer URI Field:
#if($deviceAddress.startsWith("1.0.1."))/All Customers/MSSP/testCustomer1-Customer/testCustomer1#elseif($deviceAddress.startsWith("1.0.2."))/All Customers/MSSP/testCustomer2-Customer/testCustomer2#end
What this does is assign all logs coming in from deviceAddress within 184.108.40.206/24 to testCutomer1 and from deviceAddress within 220.127.116.11/24 to testCustomer2.
If you have networks that do not end on a clean /8, /16 or /24 boundary you will need more #if and #elseif conditions, but as I said it is doable.
All the best,