Feed Hit on Host Ingress

This section describes host ingress feed hits.

Host Ingress Feed Hit – Example

2015-06-24 17:18:58 [3032] <warning>  reason=feed.ingress.hit type=host host='WIN2008R2DC01' sensor_id=2 feed_id=2 feed_name='cbtamper' ioc_type='class' ioc_value='com.carbonblack.cbfs.ingress_search.detectors.SensorTamper$Terminate' hit_field_tamper_type='AlertCBServiceStopped' timestamp='1435180738.63'

Host Ingress Feed Hit – Default Template

reason=feed.ingress.hit type=host host='{{doc['hostname']}}'
sensor_id={{doc['sensor_id']}} feed_id={{doc['feed_id']}}
feed_name='{{doc['feed_name']}}'
ioc_type='{{doc['ioc_type']}}'
ioc_value='{{doc['ioc_value']}}'
{% for k in doc['ioc_attr'] %} {{k}}='{{doc['ioc_attr'][k]}}'{% endfor %}
timestamp='{{doc['event_timestamp']}}'

Host Ingress Feed Hit – Key-Value Pairs

Key-value pairs for host ingress feed hits are a subset of those for binary ingress feed hits. See for descriptions.