Please note that there is a difference between "certified" and "supported".
What this means is that we will support any version of any product and module that we have certified. If you are experiencing unparsed events with a newer version of a product than what we have certified, and those events are not part of a module we do not currently support, then please file a support ticket and include sample logs that are not parsed. Support does have a tool that you can request to sanitize PII, etc., from your logs before submitting them.
We do not have access to every version of every device at all times. By providing these sample events, you are helping us update the parsers for you much more quickly.
If the events are from an unsupported module or new product, then this ArcSight Idea Exchange is the proper way to request that support.
Thank you,
-- Prentice S. Hayes Principal Product Manager | Cybersecurity Enterprise, Security Analytics OpenText Cybersecurity