IP Adress Not Show When Use XDR Collector

[G.Anshar]

Hello everyone, I have a question. I'm using the XDR Collector to ingest log data from both Linux and Windows servers, but some server IP addresses are not showing up. Is there any solution for this? 

[eluis · Accepted solution]

Hi G.Anshar, 

There might be 2 reasons that I can think of fast: 

1. IP address was not stored on log file. Then xdr collector, collects log file without IP 
2. Even the log is produced with the IP addresses, at parse time, that specific field is lost or not properly populated in the correct IP address field. Please
3. review that the regexes are working and properly designed 

You might check if the raw files produced in the servers are storing IP addresses

The following doc helps on parsing rules
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Parsing-Rules

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis