QuestionQ44Verified/Parsing and NormalizationCopy linkReport a problemAsk AstroTutorSave questionWhich two tags comply with the CrowdStrike Parsing Standard (CPS)?A#event.type and #event.kindB#vendor.name and #event.typeC#observer.type and #event.kindD#observer.type and #vendor.nameShow AnswerAnswerExplanationCPS identifies observer.type and event.kind as tagged fields. event.type is an event-categorization field rather than a tagged field, and the CPS vendor field is Vendor, not vendor.name.Learn moreCrowdStrike Parsing Standard (CPS) versionsShow comments1Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion