Original Client IP

[gordonwright]

We send Discovery Events, Intrusion Event Packet Data, Intrusion Events & Intrusion Event Extra Data using the estreamer client into our SIEM tool.

I cannot find the "Original Client IP" address field in my SIEM. Does the streamer client actually send this field?

I have it enabled in the HTTP pre-processor policy but don't see it listed as an option and I see the field populated in the Intrusion Events tab.

[jmoorhouse]

I think it can do it with "X-Forwarded-For" header but not "Original Client IP" header. 

https://www.cisco.com/c/dam/en/us/td/docs/security/firesight/531/PDFs/FireSIGHT-System-eStreamer-Integration-Guide-5-3-1.pdf  page 77 of the pdf shows the detail on the Extra Data records and XFF for IPv4 and IPv6.

my understanding is that estreamer will only send it if the SIEM is requesting "Extra Data" from Sourcefire.