Some Extrahop detection events are not being parsed correctly because the default LEEF parser specified in transforms.conf that comes with the Extrahop add-on for splunk is looking for very specific fields in the events. Some extrahop detection events do not contain all of the key-value pairs the LEEF parser is expecting, therefore not all events are parsing correctly. Default LEEF Parser that comes with add-on REGEX = \|appliance_id=(?P<appliance_id>[a-f0-9]+)¦categories=(?P<categories>.*?)¦det_id=(?P<id>\d+)¦det_url=(?P<detection_url>.*?)¦update_time=(?P<update_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)¦end_time=(?P<end_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)?¦risk_score=(?P<risk_score>\d+)¦start_time=(?P<start_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)¦title=(?P<title>.*?)¦offender_ip=(?P<offender_ip>.*?)¦victim_ip=(?P<victim_ip>.*?)¦offender_id=(?P<offender_id>.*?)¦victim_id=(?P<victim_id>.*?)¦desc=(?P<description>.*?)$ Example event where the default LEEF parser will not work due to missing key-value pairs Mar 31 12:13:32 10.1.9.11 LEEF:2.0|ExtraHop|Reveal(x)|7.8|extrahop-detection|xa6|appliance_id=<applianceID>¦categories=sec,sec.caution¦det_id=55834¦det_url=https://<IP address>/extrahop/#/detections/detail/55834¦update_time=Mar 31 2020 12:13:30 +0000¦risk_score=60¦start_time=Mar 31 2020 12:09:59 +0000¦title=Daily Summary: Inbound Suspicious Connections¦victim_ip=<victim_IP>¦victim_id=<victim_id>¦desc=Over the past day, servers received connections from devices with suspicious IP addresses. These IP addresses are considered suspicious based on threat intelligence found in your Reveal(x) system. Investigate to determine if the IP addresses are from malicious endpoints. ... View more