CB Defense: Syslog Error: Output_Format of JSON or CEF was not Specified

[#1]

Environment

• CB Defense Web Console: All Versions
• CB Defense Syslog Connector: All Supported Versions

Symptoms

• Error found in cb-defense-syslog.log file: 

  ERROR - output_format of json or cef was not specified

• Not receiving data into API or SIEM

Cause

The connector's cb-defense-syslog.conf file needs updated.

Resolution

Add the output format to the cb-defense-syslog.conf file immediately following the "policy_action_severity" section:

#
# Output format of the data sent. Currently support json or cef formats
#
# Warning: if using json output_format, we recommend NOT using UDP output_type
#
output_format=<format_type_here>

Additional Notes

• The output_format field supports "json" and "cef" values.
• The value defaults to "cef" if not specified.

Related Content

CB Defense: What are the Compatible Output Formats for the Syslog Connector?
Cb Defense: "ERROR - output_format of json or cef was not specified" found in the cb-defense-syslog....
Cb Defense: What do the HTTP Error Codes for the SIEM Connector mean?
CBC: How to configure cb-defense-syslog.conf for Syslog Connector
https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/integrations/