The device is discovered or provided in the delivery context (NetWitness
log headers). It's not extracted, unless it's a CEF log.The same is true
for the other two values, source and forwarder, and they can be set via
delivery context. When context i...
