Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Scenarios that Require Specific Configuration

Some Cribl logs require additional configuration in order to be parsed effectively in Exabeam. To ensure these logs reach the appropriate Exabeam parsers, the necessary steps must be performed in Cribl Stream. Follow the links in the scenarios listed below for information about the required configurations:

  • Collecting Data from a Splunk Source – Configure a pipeline in your Cribl Stream connection that extracts a specific subset of the _raw field of a Cribl log file.

  • Adding Metadata Fields – Configure default and custom metadata fields to be ingested in the expected format with Cribl raw logs. Correct configuration ensures the metadata can be accurately parsed and mapped for use in downstream applications.

  • Targeting Parsers that Require Augmented Metadata – Configure a pipeline in your Cribl Stream connection that includes a Mask function with a regex replace statement that inserts the necessary metadata key-value pairs into the _raw field of Cribl log files.

Collecting Data from a Splunk Source

To collect Cribl logs from a Splunk source, a specific subset of information in the _raw field of the log is required. In order for Splunk data to be collected and parsed appropriately in Exabeam, this subset of information must be extracted and used to replace the original _raw field in the log.

To streamline this extract and replace process, Exabeam provides a JSON code snippet. When included in a pipeline, this JSON code creates an Eval function that filters for the required information in the _raw field, extracts it, and overwrites the original field with the result.

To implement this configuration:

  1. Open your Splunk Search source and navigate to the Configuration screen. Click Event Breakers and use the Ruleset drop down to switch from the default Splunk ruleset to the Cribl ruleset called Cribl Event breaking rules for line delimited json data. Save the change.

    cribl-event-break.png

  2. Copy the following JSON code snippet and save it.

    {
  "id": "Splunk_Search_Extract_Raw",
  "conf": {
    "output": "default",
    "streamtags": [],
    "groups": {},
    "asyncFuncTimeout": 1000,
    "functions": [
      {
        "filter": "result != null && result._raw != null",
        "conf": {
          "add": [
            {
              "disabled": false,
              "name": "_raw",
              "value": "result._raw"
            }
          ]
        },
        "id": "eval",
        "description": "Update Splunk search results (broken as JSON) to overwrite _raw with result._raw"
      }
    ]
  }
}

  3. In your Cribl Stream worker group, navigate to Processing -> Pipelines.

  4. Create a new pipeline using the Import from File option. See Adding Pipelines in the Cribl documentation.

  5. Navigate to where you saved the JSON code in Step 2 and select the file. Click Import and then Save.

  6. In Cribl Stream, navigate to Routing and select QuickConnect or Data Routes to route data to a specific destination based on the standard your organization uses.

  7. Create a connection between your Splunk source on the left and your Exabeam destination on the right. See QuickConnect in the Cribl documentation.

    Note

    If you have multiple Exabeam destinations configured, make sure you select the one associated with the appropriate Cribl Cloud Collector.

  8. When the Connection Configuration dialog box is displayed, click the Pipeline option. The Add Pipeline to Connection dialog box opens.

    cribl-connection-dbox.png

  9. Select the radio button next to the pipeline you created in Step 4 and click Save. The pipeline is added to the connection between your Splunk source and your Exabeam destination.

When the pipeline configuration is complete, verify that Splunk data is collected successfully in your Cribl Cloud Collector and that the collected logs are parsed correctly in downstream Exabeam services.

Adding Metadata Fields

If you want to add specific metadata fields to your Cribl message logs and ensure that they are correctly extracted and mapped to Exabeam target fields, some configuration is required. Two types of metadata fields are supported for ingestion:

  • Default metadata fields – These fields are available natively in Exabeam but require configuration on the Cribl side to ensure the logs are ingested in the expected format. This type of metadata includes fields like siteid and hostname. When these fields are mapped in Exabeam, they appear with the m_ prefix: m_siteid, m_hostname.

  • Custom metadata fields – These fields can be configured based on any field you want to include as metadata in a Crible message log. This type of metadata requires configuration on both the Crible side and the Exabeam side. In Exabeam, a custom metadata field must be configured in the Advanced Settings section of a Cribl Cloud Collector. In the Cribl source, a field with the same name must be configured in the expected format for ingestion by the cloud collector. When these fields are mapped in Exabeam, they appear with the m_logtags_ prefix. Examples: m_logtags_department, m_logtags_servertype.

Expected Log Format

The sample below shows the expected format for log message containing both default and custom metadata. The table below the sample log explains each instance of metadata in the log.

{"message":  
        {"@timestamp": "2026-01-27T12:30:01.279Z", 
        "collector_type": "cribl-logs", 
        "collector_name": "exa-cribl-logs-SDTest1", 
        "collector_id": "9922583e-660c-42d9-aea6-9f5d8fb9b48a", 
        "message": "RAW MESSAGE GOES HERE", 
        "timezone_offset": "+0200", 
        "hostname": "test-cc-hostname", 
        "forwarder": "test-forwarder", 
        "siteid": "123123", 
        "logtags": 
                { 
                "department":"HR", 
                "servertype":"PCI", 
                }, 
        "origin":  
                {"hostname": "ngsc-si-windows-2022-core",  
                "@timestamp": "2026-01-27T12:30:01.279Z", 
                "path": "C://Program Files/logs.txt" 
                } 
        } 
}

Metadata Type

Source Field

Mapped Field

Raw Log Example

Description

Identifier Fields

The metadata fields above the message field identify the log message and its source. They are default fields for every log and do not require any configuration in Exabeam or Cribl. These fields include @timestamp, collector_type, collector_name, and collector_id.

Default Fields

These metadata fields are available by default in Exabeam but may require configuration in Cribl to ensure they are ingested as metadata by the cloud collector. When these fields are ingested, they are mapped to Exabeam fields with an m_ prefix The following fields are supported:

timezone_offset

m_timezone_offset

+0200

Specifies the time zone of the location where the log was collected. It serves as a fallback if the correct time zone cannot be parsed directly from the raw log. It can be configured in the optional Advanced Settings when creating a cloud collector.

hostname

m_hostname

test-cc-hostname

Specifies the host where the collector that ingested the log is deployed.

forwarder

m_forwarder

test-forwarder

Specifies the Syslog host from which a syslog message was sent.

siteid

m_siteid

123123

Specifies a unique site ID for data segregation purposes. It ensures that log access adheres to any configured data access permissions.

Logtag Fields

These fields are custom metadata fields and they must be included in the logtags array in the raw log structure. Custom metadata fields require configuration in both Exabeam and Cribl to ensure they are ingested as metadata by the cloud collector. When these fields are ingested, they are mapped to Exabeam fields with an m_logtags prefix. You can configure up to ten data fields as custom metadata fields as long as the field name matches in both Exabeam and Cribl configurations. Some example logtags: m_logtags.department, m_logtags.servertype

Origin Fields

In cases where logs are being sent from an external source to a central log collection location, this group of metadata fields provides specific information about the external source. For example, if a Windows Event collector sends logs to a Site Collector, the origin metadata fields describe the Window Event collector. When these fields are ingested, they are mapped to Exabeam fields with an m_ prefix. The following origin fields are supported:

hostname

m_origin_hostname

ngsc-si-windows-2022-core

Specifies the source host where the external collector is installed. In the example above, the origin hostname would be the Windows Event collector.

@timestamp

m_origin_timestamp

2026-01-27T12:30:01.279Z

Specifies the date and time the log was sent from the external host.

path

m_origin_path

C://Program Files/logs.txt

Specifies the exact file path if a log was collected from a location with multiple files.

Configuring Metadata Fields

If you want to add any of the default or origin metadata fields to your Cribl logs so they will be ingested by a Cribl Cloud Collector, some configuration on the Cribl side is necessary. Follow the procedure to Configure Cribl Stream to Output to Cloud Storage Destinations. This procedure ensures that metadata fields are included as expected in the raw log structure described above and that they will be available for parsing in Exabeam. On the Exabeam side, these types of metadata fields are already supported and available for use.

If you want to add custom metadata fields to your Cribl logs, follow the Exabeam procedure to Configure the Cribl Cloud Collector and add the following steps before you click Install to create the collector:

Note

Modifying an existing Cribl cloud collector to add custom metadata fields is not currently supported. Custom metadata can only be incorporated when you configure a new Cribl cloud collector from scratch.

  1. In the Configuration panel, below the collector Name, click the down arrow to expand the optional Advanced Settings section.

  2. In the Custom Metadata Fields section, enter a field name that you want to include as metadata. You can enter any field as long as an identically named field is configured in Cribl for inclusion in log messages.

    custom-metadata.png

  3. Click the plus icon to add the field.

  4. Add up to ten custom metadata fields and click the plus icon after entering each one.

  5. To complete the configuration on the Cribl sie, follow the procedure to Configure Cribl Stream to Output to Cloud Storage Destinations. Ensure that the same fields are included in the expected in the raw log structure described above.

Targeting Parsers that Require Augmented Metadata

Some Exabeam parsers require a specific metadata key-value pair to be present in log messages that are ingested from Cribl. This metadata must be present in the _raw field of a Cribl log file in order for the log to be evaluated by the appropriate Exabeam parser. To determine if you are using parsers that require augmented metadata, and to find the exact conditions that must be added to outgoing logs, see the table in Parsers that Require Augmented Metadata.

One method for augmenting Cribl logs with the required metadata, is to create a pipeline and apply it to the connection between the source and your Exabeam destination. Add a Mask function to the pipeline that includes Regex statements that will insert the required exact conditions into outgoing logs. The steps below outline this procedure. However, depending on the source you are using, additional filtering logic is sometimes required. Consult your Cribl representative for help in such cases.

To implement this method of augmenting log metadata:

  1. In your Cribl Stream worker group, navigate to Processing -> Pipelines.

  2. Create a new pipeline using the Create Pipeline option. See Adding Pipelines in the Cribl documentation.

  3. Open the new pipeline and add a standard Mask function to it. Configure the following information:

    • Match Regex statement – Add a Regex expression that will find the start of the log message.

    • Replace Expression – Enter the exact condition required for a specific parser designed for a specific vendor and product. To find the exact condition, see the table in Parsers that Require Augmented Metadata.

    The image below shows an example of a configured Mask function. For more information, see Function/Mask in the Cribl documentation.

    cribl-pipeline.png

    To verify that the exact condition is added properly to the front of outgoing logs, use the Simple Preview to check the outgoing message. It should look similar to the example below.

    cribl-out.png

  4. Save the pipeline configuration.

  5. Navigate to Routing -> QuickConnect.

  6. Create a connection between a specific source on the left and your Exabeam destination on the right. See QuickConnect in the Cribl documentation.

  7. When the Connection Configuration dialog box is displayed, click the Pipeline option

  8. Select the radio button next to the pipeline you just created and click Save. The pipeline is added to the connection between your source and your Exabeam destination.

When the pipeline configuration is complete, verify that data from the relevant source is collected successfully in your Cribl Cloud Collector and that the collected logs are parsed correctly in downstream Exabeam services. If the data is not parsed as expected, you might need add further logic to the pipeline. Consult your Cribl representative for help.

Parsers that Require Metadata Augmentation

This table lists Exabeam parsers, by vendor and product, that require augmentation in a Cribl log message in order for the log to be evaluated by the appropriate parser. For example, in order for a Cribl log message to be parsed by the Amazon AWS CloudTrail parser (amazon-awscloudtrail-sk4-app-activity-aws), the log message must contain a key/value pair in the form of the following exact condition: 'destinationServiceName=AWS'.

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

Vendor

Product

Exabeam Parser

Exact Condition

Amazon

AWS CloudTrail

amazon-awscloudtrail-sk4-app-activity-aws

'destinationServiceName=AWS'

amazon-awscloudtrail-sk4-app-activity-success-redshift

'destinationServiceName=AWS', 'dproc=Redshift'

AWS CloudWatch

amazon-awscloudwatch-cef-network-traffic-success-cloudwatch

'destinationServiceName=AWS', 'dproc=CloudWatch Logs'

amazon-awscloudwatch-sk4-app-activity-aws

'destinationServiceName=AWS', 'dproc=CloudWatch'

Bitglass

Bitglass CASB

bitglass-casb-sk4-alert-trigger-success-cloudsummary

'dproc=cloudsummary'

BlackBerry

BlackBerry Protect

blackberry-protect-sk4-alert-trigger-success-cyclaneprotect

'destinationServiceName=CylanceProtect'

Box

Box Cloud Content Management

box-ccm-cef-file-success-box

'destinationServiceName=Box'

box-ccm-cef-file-success-contentaccess

'destinationServiceName=Box'

box-ccm-sk4-app-login-success-login

'destinationServiceName=Box'

Cisco

Cisco Meraki MX applicance

cisco-mma-cef-alert-trigger-success-classification

'destinationServiceName=Cisco Meraki'

Cisco Umbrella

cisco-umbrella-cef-dns-response-success-adusers

'destinationServiceName=Cisco Umbrella'

cisco-umbrella-cef-dns-response-success-responsecode

'destinationServiceName=Cisco Umbrella'

cisco-umbrella-cef-http-session-proxy

'destinationServiceName=Cisco Umbrella ', 'dproc=Proxy '

cisco-umbrella-sk4-dns-response-success-roamingclient

'destinationServiceName=Cisco Umbrella'

Duo Access

cisco-duo-cef-app-login-destservicenameduo

' destinationServiceName=DUO '

cisco-duo-cef-endpoint-authentication-newenrollment

' destinationServiceName=DUO ', 'dproc=authentication-logs'

cisco-duo-cef-vpn-login-fail-loginfailure

' destinationServiceName=DUO '

cisco-duo-sk4-vpn-login-success-newenrollment

' destinationServiceName=DUO '

Citrix

Citrix Gateway

citrix-cgateway-sk4-app-activity-success-sharessend

'destinationServiceName=Citrix ShareFile', 'dproc=SharesSend'

Citrix ShareFile

citrix-sharefile-cef-file-download-success-download

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-cef-file-upload-success-fileupload

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-activity-success-editnote

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-activity-success-usermodifiedpermission

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-login-fail-failedlogin

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-login-fail-loginlocked

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-login-fail-tfaloginfail

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-login-success-loginactivity

'destinationServiceName=Citrix ShareFile'

citrix-sharefile-sk4-app-login-success-tfalogin

'destinationServiceName=Citrix ShareFile'

Cloudflare

Cloudflare Insights

cloudflare-insights-sk4-app-member-success-cloudflare

'destinationServiceName=cloudflare'

cloudflare-insights-sk4-app-member-success-cloudflare-1

'destinationServiceName=cloudflare'

Cloudflare WAF

cloudflare-waf-sk4-network-traffic-success-fwnetworktraffic

'destinationServiceName=Cloudflare', 'dproc=Firewall'

Delinea

Centrify Zero Trust Privilege Serivices

delinea-centrifyztps-sk4-app-login-centrify

'destinationServiceName=Centrify'

Egnyte

Egnyte

egnyte-e-cef-app-activity-success-create

'destinationServiceName=Egnyte'

egnyte-e-cef-app-activity-success-disable

'destinationServiceName=Egnyte'

egnyte-e-cef-app-login-success-eventlogin

'destinationServiceName=Egnyte'

egnyte-e-cef-file-permission-modify-success-assigner

'destinationServiceName=Egnyte', 'dproc=permissions-audit-report'

egnyte-egnyte-sk4-app-activity-success-addedtogroup

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-delete

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-enable

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-passwordchange

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-passwordreset

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-removedfromgroup

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-subject

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-upgradedtopower

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-verificationdisable

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-verificationenable

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-activity-success-verified

'destinationServiceName=Egnyte'

egnyte-egnyte-sk4-app-login-fail-username

'destinationServiceName=Egnyte'

engyte-e-cef-app-activity-success-update

'destinationServiceName=Egnyte'

GitHub

GitHub

github-g-sk4-repository-create-success-github

'destinationServiceName=GitHub'

Google

GCP CloudAudit

google-gcpca-sk4-app-activity-stackdriverevents

'destinationServiceName=Google Cloud Platform (GCP)'

Google Cloud Platform

google-cloudplatform-json-app-database-success-database

'dproc=Cloud PubSub'

google-cloudplatform-json-app-notificatation-success-textpayload

'dproc=Cloud PubSub'

Google Workspace

google-workspace-cef-app-activity-success-audit

'destinationServiceName=Google Apps', 'dproc=Gmail Logs'

google-workspace-cef-app-login-uniquequalifier

'destinationServiceName=Google Apps'

google-workspace-sk4-app-activity-success-admin

'destinationServiceName=Google Apps'

google-workspace-sk4-app-activity-success-calendar

'destinationServiceName=Google Apps'

google-workspace-sk4-app-activity-success-groups

'destinationServiceName=Google Apps'

google-workspace-sk4-app-activity-success-mobile

'destinationServiceName=Google Apps'

google-workspace-sk4-app-login-success-googleapps2

'destinationServiceName=Google Apps'

google-workspace-sk4-app-success-activity

'destinationServiceName=Google Apps'

google-workspace-sk4-app-success-token

'destinationServiceName=Google Apps'

google-workspace-sk4-email-send-gmaillogs

'destinationServiceName=Google Apps', 'dproc=Gmail Logs'

google-workspace-sk4-user-password-success-changepassword

'destinationServiceName=Google Apps'

Illumio

Illumio Core

illumio-ic-mix-network-traffic-illumiopce

'"src_hostname":"'

LastPass

LastPass

lastpass-l-cef-app-login-fail-failedloginattempt

'dproc=EventReporting', 'destinationServiceName=LastPass'

lastpass-l-sk4-app-activity-success-report

'dproc=EventReporting', 'destinationServiceName=LastPass'

lastpass-l-sk4-app-login-success-actionlogin

'dproc=EventReporting', 'destinationServiceName=LastPass'

lastpass-l-sk4-app-login-success-adminconsole

'dproc=EventReporting', 'destinationServiceName=LastPass'

Microsoft

Azure AD Activity Logs

microsoft-azuread-cef-app-login-clientappused

'destinationServiceName=Office 365', 'dproc=Graph Sign-In'

Azure Monitor

microsoft-azuremon-cef-app-activity-category

'destinationServiceName=Azure'

microsoft-azuremon-sk4-app-activity-alert

'destinationServiceName=Azure'

microsoft-azuremon-sk4-app-activity-loganalyticsomsworkspace

'destinationServiceName=Azure', 'dproc=Log Analytics OMS Workspace'

microsoft-azuremon-sk4-app-activity-operationname

'destinationServiceName=Azure'

microsoft-o365-cef-app-file-success-storageanalyticsevents

'destinationServiceName=Azure', 'dproc=iaas-storage-analytics-events'

M365 Audit Logs

microsoft-m365auditlogs-sk4-app-activity-managementgeneral

'destinationServiceName=Office 365', 'dproc=management-general'

Microsoft 365

microsoft-o365-cef-alert-trigger-success-spoofmail

'destinationServiceName=Office 365'

microsoft-o365-cef-app-file-success-displayname

'destinationServiceName=Office 365'

microsoft-o365-json-app-activity-graphdirectoryauditlogs

'"destinationServiceName":"Office 365"', '"dproc":"Graph Directory Audit logs"'

microsoft-o365-sk4-alert-trigger-success-graphidentity

'destinationServiceName=Office 365', 'dproc=graph-identity-protection-risk-detection'

microsoft-o365-sk4-app-activity-appactivity

'destinationServiceName=Office 365'

microsoft-o365-sk4-app-activity-auditevent

'destinationServiceName=Office 365'

microsoft-o365-sk4-app-file-workload

'destinationServiceName=Office 365'

microsoft-o365-sk4-file-write-success-filecreatedonremovablemedia

'destinationServiceName=Office 365'

Microsoft CAS

microsoft-mcas-json-alert-trigger-success-mcasalerts

'dproc=mcas-alerts'

Microsoft Defender for Endpoint

microsoft-azure-kv-network-traffic-eventhubbeat

'@timestamp'

microsoft-defenderep-sk4-alert-trigger-success-securityalerts

'dproc=Graph Security Alerts'

Microsoft DNS Log

microsoft-windows-json-dns-request-success-windns

'@timestamp":'

microsoft-windows-json-dns-response-success-logtype

'@timestamp":'

Network Security Group Flow Logs

microsoft-azure-sk4-network-traffic-nsgflow

'destinationServiceName=Azure', 'dproc=NSG Flow Logs'

Mimecast

Mimecast Secure Email Gateway

mimecast-seg-cef-app-activity-success-messageviewlogs

'destinationServiceName=Mimecast Email Security', 'dproc='

mimecast-seg-cef-app-login-fail-logonauthfailed

'destinationServiceName=Mimecast Email Security'

mimecast-seg-cef-app-login-success-audittype

'destinationServiceName=Mimecast Email Security', 'dproc='

mimecast-seg-cef-email-hold

'destinationServiceName=Mimecast Email Security'

mimecast-seg-sk4-app-activity-success-auditevents

'destinationServiceName=Mimecast Email Security', 'dproc=Audit Events'

Netskope

Netskope Security Cloud

netskope-sc-cef-app-login-success-loginsuccessful

'destinationServiceName=Netskope'

netskope-sc-cef-app-logout-logoutsuccessful

'destinationServiceName=Netskope'

netskope-sc-cef-file-browse

'destinationServiceName=Netskope'

netskope-sc-cef-file-download-success-download

'destinationServiceName=Netskope'

netskope-sc-cef-file-read-success-viewall

'destinationServiceName=Netskope'

netskope-sc-cef-file-upload-success-upload

'destinationServiceName=Netskope'

netskope-sc-sk4-alert-trigger-success-breach

'destinationServiceName=Netskope'

netskope-sc-sk4-alert-trigger-success-dlp

'destinationServiceName=Netskope'

netskope-sc-sk4-alert-trigger-success-malsite

'destinationServiceName=Netskope'

netskope-sc-sk4-alert-trigger-success-malwaretype

'destinationServiceName=Netskope'

netskope-sc-sk4-alert-trigger-success-netskope

'destinationServiceName=Netskope'

netskope-sc-sk4-app-activity-success-download

'destinationServiceName=Netskope'

netskope-sc-sk4-app-activity-success-like

'destinationServiceName=Netskope'

netskope-sc-sk4-app-activity-success-pageprefetched

'destinationServiceName=Netskope'

netskope-sc-sk4-app-activity-success-upload

'destinationServiceName=Netskope'

Okta

Okta Adaptive MFA

okta-amfa-sk4-app-appactivity

'destinationServiceName=Okta'

okta-amfg-cef-endpoint-login-fail-invalidtoken

'destinationServiceName=Okta'

OneLogin

OneLogin

onelogin-o-cef-app-login-assumingactinguserid

'destinationServiceName=OneLogin'

Ping Identity

PingOne

pingidentity-pingone-sk4-app-activity-ping

'destinationServiceName=Ping'

pingidentity-pingone-sk4-app-activity-ping-1

'destinationServiceName=Ping'

pingidentity-pingone-sk4-vpn-login-success-pingauthsuccess

'destinationServiceName=Ping'

Salesforce

Salesforce

salesforce-sf-cef-file-download-success-cloud

'destinationServiceName=Sales Cloud'

salesforce-sf-cef-file-upload-success-cloud

'destinationServiceName=Sales Cloud'

salesforce-sf-sk4-app-activity-success-auditevent

'destinationServiceName=Sales Cloud'

ServiceNow

ServiceNow

servicenow-s-cef-file-syscreated

'destinationServiceName=ServiceNow'

Slack

Slack

slack-s-cef-file-success-action

'destinationServiceName=Slack'

Symantec

Symantec Advanced Threat Protection

symantec-edr-json-app-notification-success-21

'"destinationServiceName":"Symantec"'

Symantec CloudSOC

symantec-cloudsoc-cef-file-activity-symanteccloudsoc

'destinationServiceName=Symantec CloudSOC'

symantec-cloudsoc-sk4-alert-trigger-success-fromdetect

'destinationServiceName=Symantec CloudSOC', 'dproc=Detect App'

Symantec Web Security Service

symantec-fireglass-cef-http-session-url

'destinationServiceName=Symantec WSS'

symantec-wss-sk4-http-session-denied

'destinationServiceName=Symantec WSS'

symantec-wss-sk4-http-session-observed

'destinationServiceName=Symantec WSS'

symantec-wss-sk4-http-session-proxied

'destinationServiceName=Symantec WSS'

symantec-wss-sk4-http-session-symantecwss

'destinationServiceName=Symantec WSS'

Tenable.io

Tenable.io

tenable-t-sk4-alert-trigger-vulnerability-1

'destinationServiceName=Tenable.io'

VMware

Carbon Black CES

vmware-carbonblack-sk4-app-activity-auditlogs

'destinationServiceName=CB Defense', 'dproc=auditlogs'

vmware-carbonblack-sk4-app-activity-cbdefense

'destinationServiceName=CB Defense'

Carbon Black EDR

vmware-carbonblackedr-sk4-app-notification-success-carbonblackcloud

'destinationServiceName=Carbon Black Cloud'

vmware-carbonblackedr-sk4-endpoint-activity-apicall

'destinationServiceName='

Zoom

Zoom

zoom-z-sk4-app-activity-success-operator

'destinationServiceName=Zoom'

zoom-z-sk4-app-login-success-signin

'destinationServiceName=Zoom'