- Ensure that the appropriate event selections are made in /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf file :
- Example (note: not all configurations will be the same) :
events_raw_sensor=ingress.event.procstart,ingress.event.netconn,ingress.event.processblock,ingress.event.emetmitigation
events_watchlist=watchlist.hit.process,watchlist.hit.binary,watchlist.storage.hit.process,watchlist.storage.hit.binary
events_feed=feed.ingress.hit.process,feed.ingress.hit.binary,feed.ingress.hit.host,feed.storage.hit.process,feed.storage.hit.binary,feed.query.hit.process,feed.query.hit.binary
events_binary_observed=binaryinfo.observed,binaryinfo.host.observed,binaryinfo.group.observed
events_binary_upload=binarystore.file.added
- Ensure the proper settings are made in the /etc/cb/cb.conf file :
- As an example, if only binarystore.file.adds are being seen in the S3 bucket, verify the following settings in the cb.conf file, particularly DataStoreBroadCastEventTypes:
# If this property is not empty, it will enable publishing of incoming events from
# sensors onto RabbitMQ PUBSUB enterprise bus (see RabbitMQ (cb-rabbitmq service)
# settings in this file). The value of this property consists of one or more of the
# following comma-separated event types that should be published:
# * procstart (or process)
# * procend
# * childproc
# * moduleload
# * module
# * filemod
# * regmod
# * netconn
# If you wish to subscribe for ALL of the above events, "*" value can be specified.
# Each event type will be published to its own topic: ingress.event.<event type>
# DatastoreBroadcastEventTypes=procstart,netconn
- As another example, if Raw Events are missing verify EnableRawSensorDataBroadcast=True
See this article for more information on enabling RawEvents.
See the Related Content below for more information on the Event Forwarder