Cisco Bug: CSCvu28169 - XFF data is not seen on the events of ncore ArchSight console GUI
Jun 18, 2020
- Cisco Firepower Management Center
Known Affected Releases
Symptom: On the ncore ArchSight, XFF data is not seen on the events of ncore ArchSight console GUI. Same information is visible in ncore Splunk in the same version 3.5.3 Conditions: 1. Enable the XFF data in NAP on FMC side. 2. Enable Extra data in the Estreamer. 3. Check, the events on the ncore ArchSight console GUI, XFF data is NOT available. 4. Check the XFF data in the FMC side of the connection events and its there. Hence, we concluded this is a bug in ncore ArchSight, which needs to be fixed.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.
Bug Details Include
- Full Description (including symptoms, conditions and workarounds)
- Known Fixed Releases
- Related Community Discussions
- Number of Related Support Cases