CB Response: How to verify when the event-forwarder pulls events from Response
search cancel

CB Response: How to verify when the event-forwarder pulls events from Response

book

Article ID: 290640

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Determine when an event was received by the event-forwarder

Environment

  • CB Response Server: All Versions
  • CB Event-Forwarder: 3.4

Resolution

If saving incoming events to event_bridge_output.json, the event, along with the save time can be found there. 

Additional Information

  • Verifying when the event has reached the event-forwarder will help narrow down delays between CB Response and SIEM alerts