Thanks, If I stripped of everything after the last pipe, I get events. e.g. Trend App is looking for: cef_severity or dvchost or LI_Description etc. But the SNS log from trend has: severity, OSSEC_Hostname and OSSEC_Description. I changed the searches trying to find something what matches. And this works... But, I am afraid when the first update of the trendapp comes along, the original searches are back and the app will break again. Also I am not sure if the replacement keys I used give the same results as the original. Question 1: Can I changes the dashboards without consequences for new versions of the trend app? Question 2: Is there a translation table between the SNS (OSEC etc) and TrendApp (CEF) keys? I think it is strange that Trend uses different keys for this? But maybe I am the only one 🙂 Thanks Remco ... View more