Environment
- Carbon Black Cloud Console: All Verisons
- Alert Forwarding to S3
- API v6
Symptoms
- Alerts forwarded to S3 contain a category value of "WARNING" or "NOTICE" while the UI/API show "THREAT" or "MONITORED"
- Searching alert_category in UI for WARNING or NOTICE returns no results
Cause
A design gap in the way information is sent between the alert forwarder and API
Resolution
- Future versions of the alert forwarder will be updated to show "THREAT" or "MONITORED" in the category
- When searching for categories, convert the values depending on the environment
|
Alert Forwarder (category)
|
UI (alert_category)
|
API v6 (category)
|
|
WARNING
|
THREAT
|
THREAT
|
|
NOTICE
|
MONITORED
|
MONITORED
|
Additional Notes
Legacy services used additional categories which are not used for any alerts including INFO, MINOR, SERIOUS, and CRITICAL
Related Content
