Unanswered questions

SummaryThe Securonix Syslog Connector should preserve the TCP peer/source IP received by syslog-ng and make it available as event metadata to the Ingester, parser, enrichment engine, and normalized event fields.Current behaviorUnix/Linux events are received over TCP syslog and parsed correctly. However, the TCP source IP visible at the collector is not written together with the raw event.An isolated test using the same syslog-ng binary confirmed that ${SOURCEIP} is available at the collector layer, but this metadata is not preserved in the event written to the Ingester staging path.Business impactThe current behavior affects asset identification, enrichment, searches, correlation, investigation, reporting, and coverage validation for Unix/Linux sources.The impact is greater when a source sends localhost as its syslog hostname:devicehostname=localhostipaddress=UNKNOWN In that scenario, the parser has no reliable identifier to determine which system generated the event.This affects multi

Hello Team, We would like to submit an enhancement request regarding Incident Report exports.Currently, the report header fields such as Start Date and End Date correctly reflect our configured tenant timezone (Asia/Ulaanbaatar). However, the Date/Time and Last Status Update fields within the exported report continue to display timestamps in UTC.Based on the support team's investigation, this behavior is a product limitation and cannot be modified through configuration changes.Our SOC team relies heavily on exported incident reports for security investigations, auditing, and compliance activities. The use of UTC timestamps in exported reports requires manual time conversion and creates operational challenges.In addition, this issue has been identified as a PCI DSS finding in our environment. To meet compliance and operational requirements, we need all timestamps within exported incident reports, including Date/Time and Last Status Update, to be displayed in our configured tenant timezo