cancel
Showing results for 
Search instead for 
Did you mean: 

"Dummy" parent data source

Jump to solution

Hello,

Our ESM was configured with "dummy" Windows data sources, for ease of adding multiple client data sources.  The dummy parent has an IP address of 0.0.0.0.  

My system logs fill up with Health Monitor alerts that read "Login failed" due to "NT_STATUS_BAD_NETWORK NAME" every ten minutes.

Is there any way to keep the SIEM from checking the parent data source (while continuing to check the client data sources) or to suppress this alert?

Thank you,

- Steve

1 Solution

Accepted Solutions
McAfee Employee McAfeeSIEM_Eric
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: "Dummy" parent data source

Jump to solution

This will be seen in a later version. You can see the idea was accepted and being worked on:

https://community.mcafee.com/t5/Enterprise-Customer-Product/Ability-to-create-Folder-in-SIEM-without...

 

Thank You,
Eric

View solution in original post

4 Replies
Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: "Dummy" parent data source

Jump to solution

Hi. Intreasting Quation..

but why not to just change the dumy device Parent

from A "Connect / Authentication" device to a Receiving device for example Syslog etc. ?!

 

just change it from Windows to Linux or some other dumy device.

 

Best Regards👍👍👍

David.

Re: "Dummy" parent data source

Jump to solution

Hi David,

I can't do that.  The parent device has many client devices that are inheriting properties from it.

Thank you,

- Steve

 

McAfee Employee McAfeeSIEM_Eric
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: "Dummy" parent data source

Jump to solution

This will be seen in a later version. You can see the idea was accepted and being worked on:

https://community.mcafee.com/t5/Enterprise-Customer-Product/Ability-to-create-Folder-in-SIEM-without...

 

Thank You,
Eric

View solution in original post

Re: "Dummy" parent data source

Jump to solution

Thanks, Eric.  Good to know.

Want to Ask a Question?
Many members like to perform a search first in case other customers have already asked and answered a similar question. However, to ask a question, first select a forum then click on Post a Topic. You must sign in or log in with your existing credentials.

McAfee Service Portal customers please use your existing username and password to log into the community.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community