Absent Member.
Absent Member.
584 views

missing ipv6 token operations

Jump to solution

Hello community,

Sorry, but I have another problem with a Flex connector (Smart Connector Syslog 5.2.7.6474.0).

I have a "group" with the values "-", an IPv4 or an IPv6 address.

So I choosed token.type=String for this group.

To get my IPv4 address out of there I used event.sourceAddress=__oneOfAddress(mySourceAddress)

which works perfectly fine. Even with a dash ("-") in the group the value is just empty. Exactly as expected. Also with an IPv6 address, the value is empty.

BUT

Now I want to have an eventually IPv6 address in this group in event.deviceCustomIPv6Address2. So this field expects a type IPv6Address, right? In the documentation (DevGuide 09/28/2012) there is no token operator for a convertion from String -> IPv6Address.

I even tried to wrap arround with the IPAddress type, but the field expects an IPv6Address type?

So how do I get this original String into an IPv6Address field? Or is the only possibility to get an IPv6 address into a mapping when token.type=IPv6Address?

Is it planned that there will be convertion token operations for String to IPv6Address or how to work around the whole issue?

Thanks again for your support!

   Sebastian Wieseler

Labels (3)
0 Likes
1 Solution

Accepted Solutions
Absent Member.
Absent Member.

ArcSight support helped me out with the right functions:

event.deviceCustomIPv6Address1=__stringToIPv6Address(__getIpV6AddressFromHighLow(SrcIPv6High,SrcIPv6Low))

event.deviceCustomIPv6Address2=__stringToIPv6Address(__getIpV6AddressFromHighLow(DestIPv6High,DestIPv6Low))

event.deviceCustomIPv6Address3=__stringToIPv6Address(__getIpV6AddressFromHighLow(IP_V6_HIGH,IP_V6_LOW))

event.deviceCustomIPv6Address1Label=__stringConstant(SrcIPv6)

event.deviceCustomIPv6Address2Label=__stringConstant(DstIPv6)

event.deviceCustomIPv6Address3Label=__stringConstant(DvcIPv6)

So for me, with mySourceAddress as a String

event.deviceCustomIPv6Address1=__stringToIPv6Address(mySourceAddress)

worked for me.

BUT: Don't wonder if the Regex Connector tool won't show the valid IPv6 Address in the deviceCustom field. Seems like the Regex tool got the function, but is unable to handle IPv6 addresses properly.

So yea. Hopefully this information is useful for somebody else as well.

Best Regards,

   Sebastian

View solution in original post

0 Likes
1 Reply
Absent Member.
Absent Member.

ArcSight support helped me out with the right functions:

event.deviceCustomIPv6Address1=__stringToIPv6Address(__getIpV6AddressFromHighLow(SrcIPv6High,SrcIPv6Low))

event.deviceCustomIPv6Address2=__stringToIPv6Address(__getIpV6AddressFromHighLow(DestIPv6High,DestIPv6Low))

event.deviceCustomIPv6Address3=__stringToIPv6Address(__getIpV6AddressFromHighLow(IP_V6_HIGH,IP_V6_LOW))

event.deviceCustomIPv6Address1Label=__stringConstant(SrcIPv6)

event.deviceCustomIPv6Address2Label=__stringConstant(DstIPv6)

event.deviceCustomIPv6Address3Label=__stringConstant(DvcIPv6)

So for me, with mySourceAddress as a String

event.deviceCustomIPv6Address1=__stringToIPv6Address(mySourceAddress)

worked for me.

BUT: Don't wonder if the Regex Connector tool won't show the valid IPv6 Address in the deviceCustom field. Seems like the Regex tool got the function, but is unable to handle IPv6 addresses properly.

So yea. Hopefully this information is useful for somebody else as well.

Best Regards,

   Sebastian

View solution in original post

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.