Versions Compared

Version Old Version 1 New Version 2
Changes made by

Former user

Virginia Camuñas Núñez

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
maxLevel2
typeflat

Introduction

The tables beginning withcef0.vmwareCarbonBlack identify events in CEF format generated by VMWare CarbonBlack Endpoint Services.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

  • cef0.vmwareCarbonBlack.appControl