Query the CB Defense datastore for information on individual endpoint events for enrichment.

 Retrieves all notifications and alerts with Event Types:

• “NETWORK”
• “FILE_CREATE”
• “REGISTRY_ACCESS”
• “SYSTEM_API_CALL”
• “CREATE_PROCESS”
• “DATA_ACCESS”
• “INJECT_CODE”

Every retrieved event contains a field "alertScore". 

• If alertScore  < 3 - the event is considered as notification
• Events with higher scores are considered as alerts.

For more information, please refer to:
https://developer.carbonblack.com/reference/psc/cb-defense/latest/rest-api/

Audit log notifications. Event example 

• Log in attempts by users
• Updates to connectors
• Creation of connectors