Syslog VMWare Carbon Black Discover Events

https://docs.vmware.com/en/VMware-Carbon-Black-App-Control/8.9/cb-ac-events-guide.pdf

Carbon Black Discover Events

Base Rule

Information

General Information Log Message

N/A 

 N/A

N/A

Device Product

N/A 

 N/A

N/A

Device Vendor

N/A 

N/A 

N/A

Version

N/A 

<vmid>

Number

Event ID

N/A 

<action>

Text/String

Name of Event

 N/A

 N/A

N/A

Severity

externalId

N/A 

N/A

N/A

cat

<vendorinfo>

Text/String

N/A

start

 N/A

N/A

N/A

rt

 N/A

N/A

N/A

filePath

 N/A

N/A

N/A

fname

<object>

Text/String

N/A

fileHash

<hash>

Text/String/Number

N/A

fileId

 N/A

N/A

N/A

deviceProcessName

<process>

Text/String

N/A

dst

<dip>

Ip Address

N/A

dhost

<dname>

Text/String

N/A

duser

<account>

Text/String

N/A

dvchost

<domain>

Text/String

N/A

msg

<subject>

Text/String

N/A

sproc

N/A

N/A

N/A

prevalence

N/A

N/A

N/A

global_state

N/A

N/A

N/A

cs1Label

N/A

N/A

N/A

cs1

N/A

N/A

N/A

cs2Label

N/A

N/A

N/A

cs2

N/A

N/A

N/A

cs3Label

N/A

N/A

N/A

cs3

<policy>

Text/String

N/A

cfp1Label

N/A

N/A

N/A

cfp1

N/A

N/A

N/A

flexString1Label

N/A

N/A

N/A

flexString1

N/A

N/A

N/A

cfp2Label

N/A

N/A

N/A

cfp2

N/A

N/A

N/A

flexString2Label

N/A

N/A

N/A

flexString2

N/A

N/A

N/A