Forcepoint DLP Parsing Rule

Parsing Rule

Forcepoint DLP

Details

IDforcepoint_dlp_ParsingRule
From Version8.3.0

Source

ForcepointDLP.xif ForcepointDLP.yml
Download History Raw 
[INGEST:vendor="Forcepoint", product="Forcepoint DLP", target_dataset="forcepoint_forcepoint_dlp_raw", no_hit=keep]
alter _time = timeStamp;