Cadet 1st Class
Cadet 1st Class
271 views

get asset Address knowing the asset name

knowing the asset name , how can i get the asset address ?

Labels (1)
0 Likes
5 Replies
Fleet Admiral
Fleet Admiral

Hi Maged,

In what aspect are you trying to get this lookup to work?

Are you saying that on some event, you have a device's hostname, and you would like ArcSight to poplulate it's related 'address' field as well?

0 Likes
Cadet 1st Class
Cadet 1st Class

i have correlation events with assetnames

and i need to add a field with address too 

0 Likes
Fleet Admiral
Fleet Admiral

You'll need to make sure you have all the fields that you want in your correlated events under the "Aggregation" tab of the alert rule that generated those correlated events.

Put the deviceAddress/sourceAddress/targetAddress field under the tab: "aggregate only if these values are the same"

This will allow the correlated event to have the address value as well.

0 Likes
Cadet 1st Class
Cadet 1st Class

so there is no function that can be built  to have esm resolve a given asset name to its IP ?

0 Likes
Fleet Admiral
Fleet Admiral

There are two different places that you can accomplish this - you configure the connector to do DNS lookups, or have a rule action to do the lookup and then set a field on a correlated event. That second option isn't 'built-in', but is definitely doable.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.