Precedence order of HEC tokens and metadata field values

You can secure your HEC receiver in your Edge Processors by requiring incoming HTTP requests to be authenticated using a HEC token.

Additionally, you can specify source and source type values for some of the metadata fields in the events.

Source field

When you send data out from your HEC data source to an Edge Processor, the value of the source field is determined based on the following precedence order:

  1. The source value that is already specified in the event before the Edge Processor receives it.
  2. The source value that is specified in the HEC token being used.

Source type field

When you send data out from your HEC data source to an Edge Processor, the value of the sourcetype field is determined based on the following precedence order:

  1. The sourcetype value that is already specified in the event before the Edge Processor receives it.
  2. The sourcetype value specified in the HEC token being used.