App Control: Syslog Parsing Errors After Upgrade to 8.5.2

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Parsing of syslog is incorrect after upgrade to 8.5.2

Environment

• App Control Server: 8.5.2 (Formerly CB Protection)

Cause

The Product name and vendor within the output has changed from CB Protection to Carbon Black App Control. The configuration may not be parsing the new values correctly

Resolution

Update your SIEM using the new configurations, in the Events Integration guide. Making note of the name change:
Vendor:

VMware_Carbon_Black

Product:

App_Control

 

https://community.carbonblack.com/t5/Documentation-Downloads/VMware-Carbon-Black-App-Control-Events-Guide-v8-5-2-pdf/ta-p/95114