An event is any observable occurrence. Logging is the process of recording events to provide an audit trail that can be used to understand the activity of a system. In the context of Helix Enterprise, an event refers to a specific log entry.
Each event found within log data in Helix Enterprise is assigned a unique identification number as it enters Helix Enterprise through the Communications Broker Sender within your environment.
Log data from each device is run through a parser, if one is available. Parsers separate the data in events into fields and label those fields according to the taxonomy. The taxonomy names and defines types of data that appear in events.
After being parsed, each event has two parts: the parsed fields and the raw message. Parsed fields have the following advantages:
Can be searched using the full Search TQL
Have pivoting capability when the event appears in search results
Provide more accurate data for matching against intelligence indicators
If an event is not parsed, the raw message is still indexed and can be searched as a string. Helix Enterprise still attempts to match the raw message against intelligence indicators but more false-positive hits may result.
When an event matches intelligence, Helix Enterprise generates a synthetic event for that intel hit. Having a synthetic event allows you to search more effectively for intel hits. Synthetic events are also generated for Analytic observations.