Is the Sensor Group Name or ID Included In the Raw Event Data from the Event Forwarder?

Products

• Carbon Black EDR

Issue/Introduction

Is the sensor group name or id included in the raw sensor events from the event forwarder? 

Environment

• Carbon Black EDR: All Versions
• Carbon Black Event Forwarder: All Versions

Resolution

No, the raw sensor event data does not include the sensor group name or id in the available fields. 

Additional Information

• The data comes directly from the raw sensor protobuf before it hits the EDR server for processing. This data cannot be added in a configuration. Using the computer_name or sensor_id may be the best field to use for filtering.