CA ITM Reporting

[RSAAdmin]

We are currently using CA's Integrated Threat Management for our antivirus/malware tool.

We are collecting the logs on Envision just fine, I am having a difficult time getting any reporting to work.

I know that the dtype=91 but reporting on any of the events from CAITM is not working for me.

Anyone already doing this? Any ideas?  

[RSAAdmin]

Update - filed a support case - looks like the XML and events do not completely match - has been sent to engineering.

[RSAAdmin]

Posting here to refresh this thread.  We also are seeing problems with parsing CA ITM data sources.  I will also poll support.  Thanks for this post.

[RSAAdmin]

This is still not fixed - case filed with support is several months old now.

It would be nice to have a supported device actually work.