CB Defense: Can the information sent to SIEMs be configured or modified?

[#1]

Environment

• CB Defense Web Console: All Versions
• CB Defense SIEM Connector: All Versions

Question

Can the information that is sent to the SIEMs be configured?

• For example: Add the Threat Category information from the CBD web console to the feed of information sent to the SIEM

Answer

At this time, the only configurations allowed for the SIEM output is what type of events are sent, configured in the Notification settings. It is not possible to modify what information is sent inside of those events.

Additional Notes

There is an open feature request in the Idea Central to add this capability to the product here: More Complete Logging of Events to SIEM through Connector Notifications 

Related Content

CB Cloud: How to Add New Notifications
CBC: How to configure cb-defense-syslog.conf for Syslog Connector