Environment
- EDR Server: All Versions
- Rsyslog
Question
Is there a CEF formatted template for Feed Hit on Host Ingress?
Answer
There is not a default version included. You can use the following and adjust to your needs
CEF:0|Carbon Black|Carbon Black|{{doc["cb_version"]|cef_escape(prefix=True)}}|reason=host_feed_{{doc['sensor_id']}}|{{doc['hostname']|cef_escape(prefix=True)}}|10|feed_name={{doc['feed_name']|cef_escape}} feed_id={{doc['feed_id']|cef_escape}} msg=report_id:{{doc['report_id']|cef_escape}} report_title:{{doc['report_title']|cef_escape}} ioc_type:{{doc['ioc_type']|cef_escape}} ioc_value:{{doc['ioc_value']|cef_escape}}{% for k in doc['ioc_attr'] %} {{k|cef_escape}}:{{doc['ioc_attr'][k]|cef_escape}}{% endfor %}
