|AlienVault Ticket ID||ENG-105803|
After upgrading to USM Appliance version 5.4, some customers noticed that AlienVault HIDS events have 0.0.0.0 as Source and Destination IPs instead of the IP address of the HIDS agent.
There is no workaround for this issue.
AlienVault has reproduced this behavior internally and is in the process of creating a hotfix release that resolves the issue. While not all customers are affected, any customer that relies on the HIDS functionality is advised to wait for the hotfix, which will be version 5.4.1.
Customers that have observed this issue in their environment after upgrading to version 5.4 should contact AlienVault Technical Support. We apologize for any inconvenience and are working as fast as possible to fix this issue for our customers.