cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Data Enrichment with Hostnames

Hello,

I have found instruction on how to enrich data with a user's full name from Activity Directory but I'm struggling to find a way to enrich the data with hostnames. This is for the purpose of including hostnames for source IP addresses. I would like a new enrichment field to show the hostname of the source IP address the same way as in the screen shot below.

Does anyone have any ideas on how to do this.

Using SIEM 10.1

Thank you,

Chris

2 Replies
Highlighted

Re: Data Enrichment with Hostnames

Highlighted

Re: Data Enrichment with Hostnames

You are not going to be able to enrich Hostnames from AD using an IP address since it does not store that information in AD.  Howerver, if you have ePO in your environment you can use that to look up a hostname, username, system description, etc and enrich data in the SIEM with those.  

For your request of getting a hostname from an IP address, the query would look something like this:

"SELECT IPAddress, ComputerName FROM ePOComputerProperties"

Once you have that you can then use the source IP of an event to "guess" the hostname of the system.  I often enrich MAC Addresses, Usernames (Very useful for FW events that are not from a NGFW), Hostname in a lot of my data sources.  Obviously you need to be careful you do not enrich data that has more valid data already in it.  For instance, you dont want to enrich a username on an AD event since that is a point of record for a login event.  However, you may want to enrich the hostname of the AD event using the source IP so that its easier for your SOC to attribute where a login failure is comming from.   

Hope this helps.  

Tags (3)
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community