CS-MARS: reveal the "Unknown reporting devices"

[rpluim]

I get a lot of events from "unknown reporting devices". How can I reveal the IP adressen of this devices?

Many thanx in advance!

[loorimar · Accepted solution]

Click on an incident that is caused by unknown reporting devices. In the incident click the "expand all" button. In the "reporting device" column look for the little button which looks like a page with zeros accross and click on it. The "raw message" column shows you the IP address of the reporting device.

[rpluim]

Thank you. This solved my problem!

Regards, Robbert

[rajett]

Click on Query/Reports. Edit Query Type.

In the pull down list "Result Format" choose "Unknown Event Report" and add in the time range you wish to run the report for.

Click "Apply" then "Submit"

If you do it for an extended amount of time, the button will automatically change from "submit inline" to "submit batch". If this happens you can find the report running in the background under the "Batch Query" subtab under "Query/Reports"

In that report you should find the unknown events and the IP addresses of the device responsible.

Raymond