Mappings: CarbonBlack LEEF Response - feed.ingress.hit.process
Input | Value |
---|---|
Vendor | CB |
Product | CB |
Log Format | LEEF |
Event ID Regex Pattern | feed.ingress.hit.process |
Output | Value |
---|---|
Vendor | Carbon Black |
Product | Response |
Record Type | Endpoint |
Cloud SIEM Schema Field | Original Record Key | Notes |
---|---|---|
device_hostname | hostname | |
device_ip | None | The static text 0.0.0.0 is populated in this schema field. |
timestamp | timestamp | We expect the orginal record value of timestamp is in the format epoch_float |