EDR: Is there a CEF Formatted Template for Feed Hit on Host Ingress?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is there a CEF formatted template for Feed Hit on Host Ingress?

Environment

• EDR Server: All Versions
• Rsyslog

Resolution

There is not a default version included. You can use the following and adjust to your needs

CEF:0|Carbon Black|Carbon Black|{{doc["cb_version"]|cef_escape(prefix=True)}}|reason=host_feed_{{doc['sensor_id']}}|{{doc['hostname']|cef_escape(prefix=True)}}|10|feed_name={{doc['feed_name']|cef_escape}} feed_id={{doc['feed_id']|cef_escape}} msg=report_id:{{doc['report_id']|cef_escape}} report_title:{{doc['report_title']|cef_escape}} ioc_type:{{doc['ioc_type']|cef_escape}} ioc_value:{{doc['ioc_value']|cef_escape}}{% for k in doc['ioc_attr'] %} {{k|cef_escape}}:{{doc['ioc_attr'][k]|cef_escape}}{% endfor %}