protected String decideSource(MappedMessage cef, RawMessage raw) {
        // Try getting the host name from the CEF extension "deviceAddress"/"dvc"
        final Map<String, Object> fields = cef.mappedExtensions();
        if (fields != null && !fields.isEmpty()) {
            final String deviceAddress = (String) fields.getOrDefault(CEFMapping.dvc.getFullName(), fields.get(CEFMapping.dvc.getKeyName()));
            if (!isNullOrEmpty(deviceAddress)) {
                return deviceAddress;
            }
        }

        // Try getting the hostname from the CEF message metadata (e. g. syslog)
        if (!isNullOrEmpty(cef.host())) {
            return cef.host();
        }

        // Use raw message source information if we were not able to parse a source from the CEF extensions.
        final ResolvableInetSocketAddress address = raw.getRemoteAddress();
        final InetSocketAddress remoteAddress;
        if (address == null) {
            remoteAddress = null;
        } else {
            remoteAddress = address.getInetSocketAddress();
        }

        return remoteAddress == null ? "unknown" : remoteAddress.getAddress().toString();
    }
@Test
    public void decideSourceWithShortDeviceAddressReturnsExtensionValue() throws Exception {
        final MappedMessage cefMessage = mock(MappedMessage.class);
        when(cefMessage.mappedExtensions()).thenReturn(Collections.singletonMap("dvc", "128.66.23.42"));

        final RawMessage rawMessage = new RawMessage(new byte[0], new InetSocketAddress("example.com", 12345));

        assertEquals("128.66.23.42", codec.decideSource(cefMessage, rawMessage));
    }