SIEM Integration - Client IP address

[IDAM09]

Hello,

We have deployed the SIEM runtime analytics report, can you confirm that the client side IP address can also being captured.

• The log field "IP Address" shows the origin of the request, which in all cases we can see is Cloudflare. Can we ingest additional data that would include the client IP whose request came through Cloudflare? (i.e. Does Saviynt application balancers log the "x-forwarded-for" header in HTTP requests? If so, can that information be presented in the same SIEM report or a different report?)

Thanks In Advance.

[rushikeshvartak]

When a client request goes through Cloudflare or any proxy, the server receiving the request (in this case, Saviynt's application) will usually see Cloudflare’s IP address as the origin. Hence end user IP will not be available Please raise idea ticket for this requirement