- Welcome to Exabeam Security Content
- What is Security Content?
- Common Information Model
- What is the Common Information Model?
- Common Information Model Context Elements
- Common Information Model Interface
- Common Information Model Event-naming Format
- Common Information Model Impact on Downstream Processes
- Using the Common Information Model to Create Custom Content
- Transitioning to the Common Information Model
- Understanding the Log
- Exabeam Parsers
- Exabeam Event Building
- Exabeam Enrichment
- Exabeam Persistence and Templates
- Exabeam Models
- Exabeam Rules
PrevNext
Defining Field Persistence
The default configuration for persistence is located in the following sections of the content_default.conf file (directory path: /opt/exabeam/config/default/ ):
RequiredPersistedEventFields– Specifies the fields that need to be persisted for every event.PersistedEventFields– For each event, specifies the fields that need to be persisted to the database, in addition to theRequiredPersistedEventFields.