Description

This article explains how to identify and fix if JSA is forwarding duplicate events to the third-party SIEM

Symptoms

Please run the below command to capture the PCAP on JSA:

 

tcpdump -i any -n -s0 -v host <IP of third party SIEM> -w From_JSA.pcap

 

Download the file From_JSA.pcap from JSA using WINSCP or any SCP method.

 

Open the PCAP file using wireshark > Right click on one packet > Navigate to Follow > TCP Stream

 

Check if there is any duplicate payloads sending by JSA.

Solution

Please navigate to Admin > Routing Rules and check if there are any duplicate rules. Remove the duplicate rules to fix the issue

If you are still facing the same issue, please contact JTAC for assistance

Modification History

2025-10-10 : Article Created