CEF module parsing, agent.name and agent.hostname are incorrectly set

Hi, Im using the Filebeat 7.6.0 to parse CEF logs from our ArcSight SmartConnector. I've noticed that agent.hostname and agent.name is incorrectly set. Agent.name should not be the hostname of the host where the SmartConnector is running, but the actual name that is configured for the SmartConnector. And agent.hostname is reporting the hostname of the host that actually created the log, the original sender, which is incorrect. agent.hostname should be the hostname of the host that is running the SmartConnector (same as cef.extensions.agentHostName).

Anyone else noticed this?

A short question here:
Do you use CEF module
or CEF processor?

Could you provide a short extract of config?

Because normally I would assume that Arcsight agent hostname would be in field cef.extensions.agentHostName

If you want to have agent.name this holds the name of where the filebeat shipper is at home:

What happens in actual version 7.7 of filebeat?

Hi, thanks for replying. I'm using the cef module in filebeat.

Ok, so agent is for Beats, got it.

That is true that cef.extensions.agentHostName is populated, but where is cef.extensions.agentName in that case? The information is necessary since a host can have multiple ArcSight SmartConnectors and the name is the only way to distinguish them from one another.

Edit: I see, this is a limitation of the CEF standard, that's why I'm missing this information.

Unfortunately CEF defines more the how you transport fields but it's not 100% consistent over the vendors.

I had a look into the Arcsight CEF implementation here:

And it looks like you have an aid field, which should be quite similar to an agentName field. So my question is, do you have an aid (Agent id) field?

Because then you could use this on.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.