-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
VMware Carbon Black Cloud (using Function app) data connector not ingesting full three type of logs - Sentinel #10440
Comments
Hi @laylavo, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 15-05-2024. Thanks! |
hi @sudkharat, may i know is there any updates ? |
Hey @laylavo, We need more time to check and investigate into this issue. Thanks! |
may i know the deadline because my cx pushes to update. Thanks |
Sure, we will share update you by- 23-05-2024. Thanks! |
Hi @laylavo, The CarbonBlackNotifications_CL is got deprecated as per Document and there is new Alert API to get Alert information. The API required the CarbonBlackOrgKey filed configured in the Environment Variable section of Function App. So kindly check on the below Highlighted parameter screenshot and fetch org_key details screenshot: - org_key in console side:- |
Hey @laylavo, Are we good with above response? please let us know you having any questions or can we close this issue. Thanks! |
@v-sudkharat Thanks for your update, we are double check your suggestion and get back to you. Please give us a time to work on it |
Hey @laylavo, Could you please ping me on -v-sudkharat@microsoft.com Thanks! |
Describe the bug
A clear and concise description of what the bug is.
In VMware Carbon Black Cloud data connector, there are three types of logs: CarbonBlackEvents_CL, CarbonBlackAuditLogs_CL, CarbonBlackNotifications_CL
After deploy Azure Function app successfully, only one CarbonBlackAuditLogs_CL appears in LAW:
To Reproduce
Steps to reproduce the behavior:
Please advice!
The text was updated successfully, but these errors were encountered: