CEF via AMA

Iron Contributor

Last Friday I setup a new Ubuntu server (20.04) in Azure and went through the steps to configure the CEF Connector via AMA. This is being configured to replace the CEF via Legacy Agent as that goes away in August. With everything configured, I reconfigured my firewalls to send data to the new collector and I can see data in the CommonSecurityLog table. However, I noticed that the Computer field now shows the Source IP address of the firewall rather than the name. With the Legacy Agent, the Computer field was populated with the name of the firewall that sent the data. This makes the data harder to parse as I need to cross-reference IP addresses to names each time. Any idea why the AMA isn't able to display the firewall name?

0 Replies