identify the sender of an HEC data flow

[gcusello]

i at all,

I'm ingesting data using HEC in a distributed infratructure using a Load Balancer to distribute traffic from many senders between our Heavy Forwarders.

Now, I need to identify the sender of each event, is there a meta-data that identify the hostname and IP address of each sender?

I didn't find it in HEC documentation.

Thank you for your support.

Ciao.

Giuseppe

[isoutamo]

I’m afraid that there haven’t this kind of information unless your data didn’t contain it.