Sourcetypes Definition with lea_opsec

[simuvid]

If I use lea_opsec to gather Checkpoint informations, I can define a simple data input for that.

But if I get Logevents from multiple Checkpoint Devices via data input, how can I configure and distinguish between different devices as sources?

Cheers,

Christian

[simuvid · Accepted solution]

Will recreate the question, trying to be more specific