I want to add a field management_address to its respective device_address..

Question

Hi,I have a case where Analyst uses the management IP, however there is a NAT address on the client side. The device address configured in the logs provide client IPs.So I am looking to add a field management_address that we will define based on the device_addressie: when an event has device_address=192.168.1.1 add field management_address=10.10.10.10I've looked into a few ways to do this. Enrichment source I didn't see a good way to go about it. Adding a custom normalizer would be possible, but would have to add a signature for every IP <:ALL>192.168.1.1<:ALL> and then add keyvalue management_address=10.10.10.10Label package would also be do-able and easier than norm signatures, but that would put the new IP in a label, rather than within the normalized event.Wondering if anyone has come up with any other solutions or ideas.

Rupsan Shrestha · Accepted Answer

Greetings!You could use dynamic enrichment for the above mentioned use case. You can create an enrichment source from a CSV where there is a mapping of the device_address with its respective management address.Something like:device_address, management address192.168.1.1, 10.10.10.10192.168.1.2, 10.10.10.20..... and so onYou can then configure an enrichment policy with following entries;key_present: device_ipenrichment source: <Uploaded_CSV>source: device_ip, operation: equals, event_key:device_ipThis will add management IP as a enriched field for thedevice IPif it equals the respective management IPin the uploaded CSV

I want to add a field management_address to its respective device_address..

1 reply

Reply

Reply

Sign up

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Scanning file for viruses.

This file cannot be downloaded