Syslog VMWare Carbon Black Computer Management Events

https://docs.vmware.com/en/VMware-Carbon-Black-App-Control/8.9/cb-ac-events-guide.pdf

Carbon Black Computer Management Events

Base Rule

Information

General Information Log Message

 N/A

N/A 

N/A

Device Product

 N/A

N/A

N/A

Device Vendor

N/A 

N/A

N/A

Version

N/A 

<vmid>

Number

Event ID

N/A 

<action>

Text/String

Name of Event

N/A

N/A 

N/A

Severity

externalId

N/A 

N/A

N/A 

cat

<vendorinfo>

Text/String

N/A 

start

N/A

N/A

N/A 

rt

N/A 

N/A

N/A

dst

<dip>

Ip Address

N/A

dhost

<dname>

Text/String

N/A

duser

<account>

Text/String

N/A

dvchost

<domain>

Text/String

N/A

msg

<subject>

Text/String

N/A

cs3Label

 N/A

N/A

N/A

cs3

<policy>

Text/String

N/A