I am having issues with action extraction on my windows addon . for example the eventcode 4624 should have an action value of success ,but nothing is being extracted and this eventcode constitutes majority of the data .the status is being extracted correctly  as success.does anyone know how action is being extracted for this eventcode.     ... View more

currently for asset correlation with ips we have infoblox ,but that only works when we are in the company premises and ip assigned on asset is part of company network.when someone works from home and the ip of asset changes due to personal internet that ip does not get added to the asset lookup as its not part of infoblox flow. i was thinking maybe using zscaler to add ip details for the asset but if there is any successful way someone used to mitigate this would be helpful .     ... View more

HI , I have a Web data model where i recently got it mapped with the dest field.the issue is that event hough every filed has a dest in the index from where i am pulling data in datamodel i still see alot of fields with value unknown for dest  while running stats or tstats command .I can see the the dest field when i specifically search it within a datamodel with a src ip . can anyone help to tell how do i rectify that .   Thanks. ... View more