What I Recommend for CB event forwarder

 # ingress.event.procstart
 # ingress.event.netconn
 # ingress.event.processblock
 # ingress.event.emetmitigation

 # watchlist.hit.process
 # watchlist.hit.binary
 # watchlist.storage.hit.process
 # watchlist.storage.hit.binary

 # feed.ingress.hit.process
 # feed.ingress.hit.binary
 # feed.ingress.hit.host
 # feed.storage.hit.process
 # feed.storage.hit.binary
 # feed.query.hit.process
 # feed.query.hit.binary

 # alert.watchlist.hit.ingress.process
 # alert.watchlist.hit.ingress.binary
 # alert.watchlist.hit.ingress.host
 # alert.watchlist.hit.query.process
 # alert.watchlist.hit.query.binary

 # binaryinfo.observed
 # binaryinfo.host.observed
 # binaryinfo.group.observed

 # binarystore.file.added