What is the best way to search for logs from unknown devices?

[KevinCole]

I have a large environment both in terms of monitored devices (logs & packets) and Netwitness infrastructure (many decoders, concentrators, and brokers).

A team that is standing up new devices to be monitored have started sending logs (they say) to a VIP sitting in front of my decoders. These devices do not have a parser built yet, and will likely not be known to Netwitness.

Without killing my Broker performance, what's the best way to determine if I've received any logs from these new, unknown devices in the last week?

[EricPartington · Accepted solution]

health and wellness > event source monitoring should have a record of that device.ip sending logs to your decoders

search in the event source column for the ip of the device logging to you and you should see it there along with the device type that the decoder thinks it might be and the times it last logged to you along with a chart of the events over time.

[KevinCole]

Thank you for the quick reply, Eric!

Turns out that we're having an unrelated, unreported issue with a load balancer, so logs weren't getting to the decoder.

But, I will save this answer for other uses.

Regards,

Kevin