CEF module parsing, agent.name and agent.hostname are incorrectly set

[undelete (Victor)]

Hi, Im using the Filebeat 7.6.0 to parse CEF logs from our ArcSight SmartConnector. I've noticed that agent.hostname and agent.name is incorrectly set. Agent.name should not be the hostname of the host where the SmartConnector is running, but the actual name that is configured for the SmartConnector. And agent.hostname is reporting the hostname of the host that actually created the log, the original sender, which is incorrect. agent.hostname should be the hostname of the host that is running the SmartConnector (same as cef.extensions.agentHostName).

Anyone else noticed this?

[Andre_Letterer (André Letterer)]

A short question here:
Do you use CEF module
https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-cef.html
or CEF processor?
https://www.elastic.co/guide/en/beats/filebeat/7.6/processor-decode-cef.html

Could you provide a short extract of config?

Because normally I would assume that Arcsight agent hostname would be in field cef.extensions.agentHostName
https://www.elastic.co/guide/en/beats/filebeat/7.6/exported-fields-cef.html

If you want to have agent.name this holds the name of where the filebeat shipper is at home:
https://www.elastic.co/guide/en/beats/filebeat/7.6/configuration-general-options.html#_name

What happens in actual version 7.7 of filebeat?

[undelete (Victor)]

Hi, thanks for replying. I'm using the cef module in filebeat.

Ok, so agent is for Beats, got it.

That is true that cef.extensions.agentHostName is populated, but where is cef.extensions.agentName in that case? The information is necessary since a host can have multiple ArcSight SmartConnectors and the name is the only way to distinguish them from one another.

Edit: I see, this is a limitation of the CEF standard, that's why I'm missing this information.

[Andre_Letterer (André Letterer)]

Unfortunately CEF defines more the how you transport fields but it's not 100% consistent over the vendors.

I had a look into the Arcsight CEF implementation here:
https://community.microfocus.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Implementation-Standard/ta-p/1645557?attachment-id=68077

And it looks like you have an aid field, which should be quite similar to an agentName field. So my question is, do you have an aid (Agent id) field?

Because then you could use this on.