Forcepoint DLP Parsing Rule

Parsing Rule

Forcepoint DLP

Details

IDforcepoint_dlp_ParsingRule
From Version8.3.0

Rules (XQL)

[INGEST:vendor="Forcepoint", product="Forcepoint DLP", target_dataset="forcepoint_forcepoint_dlp_raw", no_hit=keep]
alter _time = timeStamp;