SIEM & UEBA

 View Only
Expand all | Collapse all

Remote laptops

  • 1.  Remote laptops

    Posted Jan 14, 2022 07:49 AM
    We have a bunch of laptops that never make it into an office, so they don't connect to a collector.  We have VPN, but some users only use that rarely.  We created a NAT on the firewall to the collector and installed nxlog, and pointed nxlog to the NAT IP.  This works, until that laptop gets a different IP.  The CMDB will create a new object with the same hostname, but the new IP.  We have some laptops with a dozen CMDB objects.

    Is there a way to do either of these?

    1.  Have the supervisor give the agent the NAT IP for the collector
    2.  Make CMDB understand that IP can change and track on hostname instead


  • 2.  RE: Remote laptops

    4
    Posted Jan 18, 2022 09:25 AM
    If you are running an agent, then we merge by host name and not ip. So there would be 1 entry in CMDB with the latest IP. This was done few years ago. Let me know if this does not work this way.