cancel
Showing results for 
Search instead for 
Did you mean: 

Re: Custom parser's Device type

Jump to solution

, Correct way is to "rename" the User Defined in Receiver properties.

1. Go to Receiver properties.

2. Click on Data Sources

3. Click on Rename at the bottom.

4. Edit the User Defined 1 to appropriate name that reflects your custom parser device. Once you change this, it will reflect in your Data Source properties and custom parser rule assignment.

hope it helps,

Syed Rizvi

acommons
Level 10
Report Inappropriate Content
Message 12 of 14

Re: Custom parser's Device type

Jump to solution

I cannot see anyway to specify the Device Class if I do this. The issue is being able to set the class so that filters that use, say, CLASS:Firewall will work.

Re: Custom parser's Device type

Jump to solution

​ the issue in the original post is to not have custom data source appear as "User Defined 1" in the "Device Type" dashboard. The correct way to resolve it is to rename "User Defined 1" to something meaningful. The "Device Type" dashboard doesn't use CLASS as filter.

acommons
Level 10
Report Inappropriate Content
Message 14 of 14

Re: Custom parser's Device type

Jump to solution

That's true. I was just wondering if it fixed the other issues with locally defined devices. The ugly workaround I proposed lets the device integrate into predefined views where device class is used and it does give you a name for the device - but the wrong one. It also appears to allow the Device Type ID filter to be used as designed.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator