EDR: Is it Possible to Filter Data in Event Forwarder?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Can EDR Event Forwarder filter data?

Environment

• EDR Event Forwarder: All Supported Versions Except For v3.8.4
• EDR Server: All Supported Versions

Resolution

1. Yes, fields can be filtered within Event Forwarder.
2. Add the following to the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf configuration file if missing: remove_from_output="field to be filtered"
   1. Example below would be for filtering out command lines from being forwarded: 

      remove_from_output=command_line,cmdline

Additional Information

In Event Forwarder v3.8.4 remove_from_output variable functionality is broken.