Guest

Preview Tool

Cisco Bug: CSCvu28169 - XFF data is not seen on the events of ncore ArchSight console GUI

Last Modified

Jun 18, 2020

Products (1)

  • Cisco Firepower Management Center

Known Affected Releases

3.5.4

Description (partial)

Symptom:
On the ncore ArchSight, XFF data is not seen on the events of ncore ArchSight console GUI. Same information is visible in ncore Splunk in the same version 3.5.3

Conditions:
1. Enable the XFF data in NAP on FMC side.
2. Enable Extra data in the Estreamer.
3. Check, the events on the ncore ArchSight console GUI, XFF data is NOT available.
4. Check the XFF data in the FMC side of the connection events and its there.

Hence, we concluded this is a bug in ncore ArchSight, which needs to be fixed.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.