CEF templates missing for feed.query.hit.binary and feed.query.hit.process event types

[#1]

Version
6.1.x

Issue

CEF templates missing for feed.query.hit.binary and feed.query.hit.process event types from from /usr/share/cb/syslog_templates

Symptoms
All other event types are being forwarded to your SIEM in CEF format except feed.query.hit.binary and feed.query.hit.process

Cause
Two syslog templates are missing from the /usr/share/cb/syslog_templates directory

Solution

Copy the feed.ingress.hit.binary and feed.ingress.hit.process templates over for the feed.query.hit.binary and feed.query.hit.process templates:

cp /usr/share/cb/syslog_templates/feed.ingress.hit.process.cef.template /usr/share/cb/syslog_templates/feed.query.hit.process.cef.template

cp /usr/share/cb/syslog_templates/feed.ingress.hit.binary.cef.template /usr/share/cb/syslog_templates/feed.query.hit.binary.cef.template