Unknown Nodes

There's a variety of reasons that bogus nodes might appear, including but not limited to:

• DNS configuration issues
• Weird host file entries
• Rules firing alerts with bad field data (like an Incident Alert with the "DetectionTime" in the "DetectionIP" field)
• Devices with inconsistent logging source IPs (like a machine with multiple NICs)

Is there maybe a way to block this devices? I tried to delete one of the devices, but LEM did a scan and added the device again?

Is there maybe a way to block these devices? I tried to delete one of them, but LEM adds it again after the scan.

Do you have a screenshot to share? What kind of events are associated with these 'bogus' nodes?

No, if the LEM sees data with an IP, it'll treat it as a new source and add a node for that.  You'll need to resolve the bogus source to prevent the data from coming back.

Is there any documentation of how i can do this? I did a nslookup but get the message that the device has no domain and it is offline.

No I don't have a screenshot. I don't see the old events anymore.

If they keep coming back after you delete them, it's because new events are coming in with that DetectionIP value from one of your log sources. LEM uses DetectionIP to determine when a host is sending data to another that's picked up by LEM. We'll have to track down what that log source is to see if we can figure out why it's happening. If you double click on that node from Manage>Nodes it should do a quick search for that node's IP anywhere in your data, though if it's been too long you might have to dig farther back in time.

This is what i see when i double click on a node.