Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cisco Integrations: host.name should not be "Agent Name" #742

Closed
MarcusCaepio opened this issue Feb 23, 2021 · 2 comments
Closed

Cisco Integrations: host.name should not be "Agent Name" #742

MarcusCaepio opened this issue Feb 23, 2021 · 2 comments

Comments

@MarcusCaepio
Copy link

MarcusCaepio commented Feb 23, 2021

Hi all,
I once opened an Issue in 2019 here (elastic/beats#14933) regarding to elastic/beats#13920 , which unfortunately did not get much attention yet.
So I am not sure, if the issue is correctly placed here. But while changing to Fleets, this issue still exists and unfortunately there is no option to define processors (yet?). So maybe this should be kept in mind for further planning with the fleets integrations and can maybe speed up the main problem a little :)

Cheers,
Marcus

@MarcusCaepio MarcusCaepio changed the title Cisco Integrations: host.name should be "Agent Name" Cisco Integrations: host.name should not be "Agent Name" Feb 23, 2021
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@MarcusCaepio
Copy link
Author

I close this issue, because I just realised, that with the correct syslog config, the ASA hostname is parsed to the field host.hostname.
If anyone get this problem, too, my ASA config is:
Facility Code 4(20)
Timestamps enabled with RFC5424
Enable Syslog DeviceID (Host or contextname)
NO Emblem Message Format

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants