Skip to main content

Namespace in Chronicle forwarder

  • November 27, 2024
  • 1 reply
  • 49 views

rahul7514
Forum|alt.badge.img+10

Hi 

Can i have a asset namespace value like this "cisco-meraki-sd-wan-logs-italy" or it will not accept it , is there any naming restriction for it ?

1 reply

Forum|alt.badge.img+12

I'm not aware of restrictions, and that namespace should work, but be aware that Aliasing and Enrichment sources for Assets are Namespace aware, e.g., if you have a Namespace like above, but your Active Director context source is in the default untagged Namespace then no Aliasing will occur.

Generally, only use Namespaces if 1) you can consistently apply them to all event and context sources, or 2) you have overlapping IP address ranges and have to use them (and you still then have to address the prior issue to address)