nsacyber/Event-Forwarding-Guidance

Subscription Organization

CliffordRichmond opened this issue · 0 comments

I emailed help@intelligencecareers.gov for more specific contact information Nov. 19th but have heard nothing back yet...

I have connectivity between sources and collector, and have had events come in for test subscriptions. My question/concern is how to most simply organize individual subscriptions, given the fact that event IDs are only unique to sources, and not logs. For example, is it the case that the particular event IDs recommended to be tracked in the Excel spreadsheet "are" unique for each log, or would I have to separate each subscription by event source to be sure I was not getting different events (one I care about, and others I don't want to forward) from the same log that happened to have the same event ID?