Hello Louise, 

i don't think that this is an issue of the product itself but more of the parser.

I checked the documentation and list of the out-of-the-box solutions https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-24.4/arcsight-smartconnectors-for-other-event-sources/ but I could not find anything related to Cisco Umbrella.

Can you mention which product you deploy from that list to pars the source events?

Best Regards, 

Daniel

Hi Ionut,

The logs from Cisco Umbrella are sent to S3 bucket, so I used the Amazon S3 connector for the integration. That aside, just recently I started seeing unparsed again and all I did this time was to clear the cache and it's working fine. However, I can't always keep clearing the cache so I'm looking for a permanent fix.

Hello Louis, 

now i clear you are using the supported version S3 written on this page https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-24.1/SC_Cloud_Connectors/index.html 

Well, if you look there, we are supporting at least 2 x versions of CiscoUmbrella-ProxyLogs: CiscoUmbrella-ProxyLogs and CiscoUmbrella-ProxyLogs-V4.

Based on your error I think that the issue is that V4 has 24 tokens and not V1.

What you need to do is to make sure that you select the version that you are receiving by choosing the right Log Type as is written in this page picture how to install the Smart Connector 

https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-24.1/amazon-web-services-s3/index.html#AWS_S3_Config/installation-parameters.htm?TocPath=_____7 

and keep in mind that there are multiple Long Types and at least two for CiscoUmbrella-ProxyLogs and CiscoUmbrella-ProxyLogs-V4.

Choose CiscoUmbrella-ProxyLogs-V4 and hopefully, you will not have this issue anymore.

If the connector is already installed, which is it, then just modify the connector and replace the CiscoUmbrella-ProxyLogs with CiscoUmbrella-ProxyLogs-V4.

Also, we released a new version of connector 8.4.7, and now the CiscoUmbrella-ProxyLogs-V4 supports all 36 tokens since Cisco increased the number of tokens.

To conclude. You need to make sure that your Log Type is CiscoUmbrella-ProxyLogs-V4 and second, your S3 connector is upgraded to version 8.4.7.

Hopefully, what I said makes sense...

Best Regards, 

Daniel 

Hi Ionut.. 

Thanks for the reply. It makes lots of sense, I am currently using CiscoUmbrella-ProxyLogs-V4 on version 8.4.6 but i will upgrade to 8.4.7 right away, hopefully it works.

Hello Louis, 

welcome. It should be ok if you selected CiscoUmbrella-ProxyLogs-V4 and upgraded to the Smart Connector 8.4.7. 

If you have the chance you can download the unobfuscated parsers from our portal an take a look on the parsers.

Best Regards, 

Daniel