EDR: Is it Possible to Filter Data in Event Forwarder?
search cancel

EDR: Is it Possible to Filter Data in Event Forwarder?

book

Article ID: 287769

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Can EDR Event Forwarder filter data?

Environment

  • EDR Event Forwarder: All Supported Versions Except For v3.8.4
  • EDR Server: All Supported Versions

Resolution

  1. Yes, fields can be filtered within Event Forwarder.
  2. Add the following to the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf configuration file if missing: remove_from_output="field to be filtered"
    1. Example below would be for filtering out command lines from being forwarded: 
      remove_from_output=command_line,cmdline

Additional Information

In Event Forwarder v3.8.4 remove_from_output variable functionality is broken.