Merge pull request #2 from f8al/master

Add files via upload thanks f8al :)
carbonblack · Sep 13, 2018 · e52d7f5 · e52d7f5
2 parents e045f30 + 1a1c602
commit e52d7f5
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/TA-Cb_Defense/default/props.conf b/TA-Cb_Defense/default/props.conf
@@ -9,4 +9,4 @@ KV_MODE = json
 SHOULD_LINEMERGE = 0
 category = Splunk App Add-on Builder
 pulldown_type = 1
-
+TRANSFORM-cb-host-override = cb-host-override
diff --git a/TA-Cb_Defense/default/transforms.conf b/TA-Cb_Defense/default/transforms.conf
@@ -0,0 +1,5 @@
+[cb-host-override]
+DEST_KEY = MetaData:Host
+SOURCE_KEY = _raw
+REGEX = \"deviceName\":\s*\"(\w*\\\\)([^\"]+)\"
+FORMAT = host::$2