get asset Address knowing the asset name

[maged1]

knowing the asset name , how can i get the asset address ?

[rkent1]

Hi Maged,

In what aspect are you trying to get this lookup to work?

Are you saying that on some event, you have a device's hostname, and you would like ArcSight to poplulate it's related 'address' field as well?

[maged1]

i have correlation events with assetnames

and i need to add a field with address too 

[rkent1]

You'll need to make sure you have all the fields that you want in your correlated events under the "Aggregation" tab of the alert rule that generated those correlated events.

Put the deviceAddress/sourceAddress/targetAddress field under the tab: "aggregate only if these values are the same"

This will allow the correlated event to have the address value as well.

[maged1]

so there is no function that can be built  to have esm resolve a given asset name to its IP ?

[rkent1]

There are two different places that you can accomplish this - you configure the connector to do DNS lookups, or have a rule action to do the lookup and then set a field on a correlated event. That second option isn't 'built-in', but is definitely doable.