Security Compliance

SEM does not resolve DNS for all network nodes

This article explains why SEM does not resolve the node name and only shows the IP address.

First published date

10/10/2018 4:28 PM

Last published date

4/2/2025 10:21 PM

Overview

This article explains why Security Event Manager (formerly Log & Event Manager) does not resolve the node name and only shows the IP address.

Product section

Security Event Manager

Resolution

  • Agent nodes - SEM displays the address that the appliance sees the agent connect from as a part of the agent's information.
  • Non-agent nodes (For example, syslog, SNMP, remote devices) - SEM displays the node name as it is received in the syslog or SNMP data.
    Examples:
    • If the syslog message looks like the following:
      May 11 2012 11:06:00 192.168.168.1 Something_Cool_Happened
      SEM will display 192.168.168.1 in the node list.
    • If the syslog message looks like the following:
      May 11 2012 11:06:00 main-fw1 Something_Cool_Happened
      SEM will display main-fw1 in the node list.

 

There are no name resolutions in SEM for displaying node data outside of what the native syslog server is doing. However, name resolutions are performed in the correlation engine, such that if main-fw1 and main-fw1.domain.local and 192.168.168.1 are the same thing, these are correlated together as long as there is reliable DNS, but is not displayed anywhere.