CB Response: Alliance feed name missing from events sent over Syslog
search cancel

CB Response: Alliance feed name missing from events sent over Syslog

book

Article ID: 287792

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Missing Feed name on incoming alerts.

Environment

  • CB Response Server: 6.X

Cause

This is due to a limitation of Syslog

Resolution

As a workaround, adjust the correct /usr/share/cb/syslog_templates/ to include Threat Report IDs:
whatisthereportid={{doc['report_id']|cef_escape}}

Additional Information

  • Syslog has been replaced by CB Event Forwarder.
  • The CB Response Feeds do not apply a tag ID for the Alliance Feed name the alerts come from.