I'm working with Proofpoint Threat Response events that are being sent to our instance of Splunk using an HEC connection. The part of the threat response event
u'incident_field_values': [{u'name': u'Severity', u'value': u'Informational'},
The raw Splunk event
"incident field values": [{"name": "Severity", "value": "Informational"},
As far as I know the HEC shouldn't do any translation so how did incident_field_values become the same name using spaces instead of underscores? The version is 7.3.6.
TIA,
Joe
