Without sound like IBM support, it may be easier if you share what logs you have (anonymised) and a sample asset list (and how you're building the asset list from the logs).
Also what Version of QRadar and at the far end, what DHCP services you're using.
------------------------------
Darren H.
------------------------------
Original Message:
Sent: Thu January 23, 2020 04:57 PM
From: Talal Ansari
Subject: Asset List
Hi Guys,
I am facing an issue with my asset list in Qradar, my asset list is showing wrong user information which is making tracing an endpoint a big issue. The previous environment on which I had worked was a static one, hence adding the assets manually did the job. But the new environment is running on DHCP which makes it difficult to track the user along with the host name and mac address. My analysts have to search in the DHCP logs separately for the related IP to find the relevant information. Is there a way for my qradar to update the asset list automatically from DHCP? A step by step guide will be of great help. TIA
------------------------------
Talal Ansari
------------------------------