Microsoft ISA Server event source - unknown

[RSAAdmin]

We configured our Microsoft ISA server to send logging to our enVision. We configured the Firewall logging, Windows event logs , and Web Proxy logs. We set event source tp multi-device. We know have 3 devices in enVision. 1. Windows Events (NIC). 2. MIcrosoft Internet Security and Acceleration Server and 3. "Unknown"

The unknown should be the Web Proxy, but we don't see a device type for it.

Is anyone else having this problem?

[RSAAdmin]

Yup same problem here, but...on one array only 1 ISA has an unknown while the other node doesn't. Doesn't make sense since array has consistent settings and logging, I personally don't think it's figuring it out correctly and were losing info to unknown