i just integrated two HPUnix in my SA server then i got, logs are coming as two different device type,refer attached screen shot
is this issue of SA or event source?
So, we had an issue with a load balancer showing up as a Junos Router because it was running Junos OS. If your device is running a Junos/Juniper OS, it's being parsed as a Junos device. It's a parsing issue, and you need to tweak your parser to acknowledge the issue, or escalate to RSA's dev team. Hope this helps
i think its source, check the session details
authentication success log come under HPUnx or authentication failure log coming under junosrouter from same device ip
can you post the sample event? looks like both parser hpux and junosrouter enabled.
please, Have a look on this document
Just wondering whether your network has junosrouter or not, which sent the events to SA?
no junos router, just check devcie ip, hp unix and junosrouter is same
can you export all the logs?
Retrieving data ...