Content Comparison

...

In this case, the valid data tables are:

Tags	Data tables
`cef0.forescoutTechnologies.counteract`	`cef0.forescoutTechnologies.counteract`

How is the data sent to Devo?

...

Field	Type	Extra field	Source field name
eventdate	`timestamp`
rawMessage	`str`	✓
hostchain	`str`	✓
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
dhost	`str`
dmac	`str`
dntdom	`str`
dst	`ip4`
duser	`str`
dvchost	`str`
dvc	`ip4`
rt	`timestamp`
tag	`str`	✓	cefTag