About The Device
VMware Carbon Black Cloud™ is a cloud-native platform delivering best-in-class, next-generation antivirus and endpoint detection and response without compromising system performance. The platform consolidates multiple endpoint security capabilities using one agent and console, helping you operate faster and more effectively.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | VMware (Previously Known as Carbon Black and before that Bit9+Carbon Black) |
Product Name | Carbon Black Cloud (Previously Known as Carbon Black Predictive Security Cloud) |
Type of Device | Hybrid |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol | Log Collection Method | Data Source |
|---|---|---|---|---|
Carbon Black | CB_EDR | JSON | C2C | https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3 |
Device Configuration
Prerequisites
Create an S3 bucket with a policy that grants the necessary permissions to the principal role used by the Data Forwarder. This policy is a resource-based policy.
Reference Links:Kindly create SQS and attach it with S3. (If you are using source type as SQS then this step is required)
Configuring AWS Simple Queue Service (SQS) with S3 Storage
Data Forwarder Configuration
Carbon Black Cloud Data Forwarders can be used to send bulk data log types categorized as Alerts, Endpoint events and Watchlist hits to an Amazon Web Services (AWS) S3 bucket. You need to create separate Data Forwarders to send each of these three log categories to different sub-folders in the same AWS S3 bucket.
Steps to create Data forwarders
Log in to the Device Console.
On the left navigation pane, click Settings > Data Forwarders.
In the Add Forwarder page,
Enter the Basic Info:
Name: Provide a unique name for the Data Forwarder.
Type: Select one of the following:
Alert
If you select the Alert option, proceed to Step 5 after providing S3 bucket name and S3 prefix.
Endpoint event
If you select the Endpoint Event option, proceed to Step 4 to define the filter data after providing S3 bucket name and S3 prefix.
Watchlist hit
If you select the Watchlist hit option, proceed to Step 5 after providing S3 bucket name and S3 prefix.
S3 bucket name: Enter the S3 bucket name you created on AWS
S3 prefix: Enter the name of the Folder you created in the AWS S3 bucket.
If you have selected Endpoint Event in the previous step, you must click to + icon to expand options under Filter Data and keep Basic filter selected. Kindly keep below values against their properties to filter events.
a. Filter Data by - Event Origin.
b. Data Must - match any of
c. Value(s) - Select EDR and NGAV
Set the forwarder status to either On or Off.
To apply the changes, click Save.
While configuring Data Forwarder for Endpoint Events, Adaptive MxDR recommends selecting Basic filter to allow all the endpoint events. Customer can use Custom filter option to filter out events as per their choice.
If you select On, data matching the criteria you specified will begin forwarding to the AWS S3 bucket you defined.
Test a New Data Forwarder:
You can test the Data Forwarder connection between the Carbon Black Cloud and the AWS S3 Bucket.
Click Settings > Data Forwarders from the left navigation pane.
In the right pane, click on Checkmark button to test the data forwarder. A dropdown banner displays and informs you of the test result.
Example Result - S3 bucket is connected.
Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS. (IAM policies for SQS are required if you are using SQS as a source type).
Below is the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):
SQS: If you are using source type as SQS, SQS URL should be allowed.
Amazon Simple Queue Service endpoints and quotas - AWS General Reference
Integration parameters
Property | Default Value | Description |
|---|---|---|
REGION | N/A | The region where the S3 bucket resides. For a list of regions, see Amazon S3 regions. |
S3 URI | N/A | The S3 URI to ingest. |
URI IS A | Directory which includes subdirectories | The type of file indicated by the URI. Valid values are:
|
SOURCE DELETION OPTION | Never delete files | Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are:
|
ACCESS KEY ID | N/A | This is the 20 character ID associated with your Amazon IAM account. |
SECRET ACCESS KEY | N/A | This is the 40 character access key associated with your Amazon IAM account. |