Resolve Known Hosts
To resolve a Known Host, a search is conducted for Hosts assigned to the Log Source Host Entity in the following order until the search is resolved
- If the Log Source Host Entity is a child entity:
- Search for Hosts within the Log Source Host Root Entity.
- Search for Hosts within other child Entities within the Log Source Host Root Entity.
- If the Log Source Host Entity is a Root Entity, search for Hosts within any child Entities within Log Source Host Entity. This must resolve to a single Host. If the search returns more than one Host, it goes to Step 5.
- If there is a public IP Address, search other Root Entities, but not their child Entities. This must resolve to a single Host. If the search returns more than one Host, it goes to Step 5.
- Search for Hosts within the Global Entity.
- Known Host is not resolved.