Carbon Black Cloud: Is There A Cap of Notification Received by Single Syslog Call

[#1]

Environment

• Carbon Black Cloud Backend: All supported versions

Question

Is There A Cap of Notification Received by Single Syslog Call?

Answer

There is a cap of 2500 notifications that can be pulled in a single Syslog call.

Additional Notes

There is a possibility CBC syslog falls a little behind during peak hours depending on the configured polling interval, which will catch up as the flow slows down later.

Related Content

Endpoint Standard Integrations - Carbon Black Developer Network