Mappings: CarbonBlack LEEF Response - feed.ingress.hit.process
| Input | Value |
|---|---|
| Vendor | CB |
| Product | CB |
| Log Format | LEEF |
| Event ID Regex Pattern | feed.ingress.hit.process |
| Output | Value |
|---|---|
| Vendor | Carbon Black |
| Product | Response |
| Record Type | Endpoint |
| Cloud SIEM Schema Field | Original Record Key | Notes |
|---|---|---|
| device_hostname | hostname | |
| device_ip | None | The static text 0.0.0.0 is populated in this schema field. |
| timestamp | timestamp | We expect the orginal record value of timestamp is in the format epoch_float |