Security ContentExabeam Security Content in the Common Information Model

A single event builder can match the output of multiple parsers. This flexibility is necessary to handle scenarios where there are multiple available formats for a given event and each requires a different parser. This can reduce the number of event builders in the system and make them easier to manage.

It's also possible that the output of a single parser can be matched to multiple event builders that will create different types of events. Flexibility in this direction allows event building to vary based on the information extracted from the log. Typically in this scenario, mutually exclusive conditions ensure that the parsed message is matched with the correct event builder.