#SPLUNK CIM HOW TO#
#SPLUNK CIM UPGRADE#
#SPLUNK CIM FULL#

Carbon Black Cloud alerts and events contain a variety of timestamps to provide insight into various stages of the data.

What is the difference between the Message Time and Timestamp field in Splunk?.

The app has been verified by AppInspect and is under assessment for Splunk Cloud.

Yes, it uses the Event and Alert models from the Splunk CIM.

Data Forwarder Configuration API Documentation.

A step-by-step guide on configuring ingest from an AWS S3 bucket to Splunk.

An end-to-end configuration video is available on the Carbon Black User Exchange.Configuring the forwarder for Events and Alerts is available here.Do we have any Splunk documentation to reference for customers that wish to ingest the Carbon Black Cloud Data Forwarder data into Splunk?.

#SPLUNK CIM UPGRADE#

If you are using Splunk version 7.x, you will need to upgrade the version of Splunk to use the new Carbon Black Cloud app.

What version of Splunk is supported for Carbon Black Cloud?.

Is there a limit to the number of Audit Logs that are pulled on each sync?.

Switch to ingesting Alerts via the Forwarder.

Change the polling interval from the default of 300 seconds to 120 or 60 seconds.

Use the Query to filter out alerts you aren’t finding value in.

Follow recommendations from our Threat Research team here.

CB Analytics alerts that are known-good in your environment can be tuned from the Carbon Black Cloud console using the Dismiss all future alerts functionality.Tune alerts to reduce overall alert volume.If your organization has more than 10,000 alerts each polling interval, you can: Is there a limit to the number of alerts that are pulled from the API on each sync when using the built-in Input?.Customers on Splunk 7.0 should upgrade the version of Splunk to use the new Carbon Black Cloud app. A new VMware Carbon Black Cloud app available on SplunkBase supports distributed environments and includes new Input and Technology add-ons.Ĭustomers who are on Splunk 8.0+ should move to the new app to take advantage of improved data ingest options and a larger range of adaptive response features.Do you know if and when a new Splunk TA will be updated? We are using an earlier Splunk TA which was last updated in 2015.Note: Do not include a trailing slash, the value should only be the hostname e.g.

#SPLUNK CIM FULL#

When configuring the Carbon Black Cloud Environment URL for API Token Configuration, use the dashboard URL without the Full detail on the URLs for each environment are available here.What is the URL that we should be using for API configuration? The app does not require all of the data however parts of the dashboards may not be available if it relies on data types that are not ingested.Can the VMware Carbon Black Cloud Splunk App ingest only the Alerts and not the event data or the audit information?.This approach supports ingesting the enriched events associated with CB Analytics Alerts through an Alert Action. The alternative is to use the built-in inputs packaged with the VMware Carbon Black Cloud App or Input Add-on, which leverages the Carbon Black Cloud REST APIs. This approach is required to ingest Endpoint Event data. The Forwarder is the recommended approach for ingesting Alerts and Endpoint Events into Splunk due to its reliability, scale, and low latency.Is it a requirement to use the data forwarder?.A video demoing the configuration is available here.

#SPLUNK CIM HOW TO#

Do we have a document outlining how to install & configure the new version of Splunk for Carbon Black Cloud?.

See Audit Logs under the Input Configuration Is there is a way to bring in the Carbon Black Cloud audit logs to Splunk?.For example, if Carbon Black Cloud detects LSASS memory scraping, automatically get the logged in users and move the device to a more restrictive policy.Enables alert actions & adaptive response to automate context gathering and remediation.Supported on Splunk 8.0, 8.1, 8.2, Splunk Cloud, and Splunk ES 6.x.Support for Alerts, Audit Logs, Live Query Results, and Vulnerability Assessment data via a built-in input using the Carbon Black Cloud APIs.Support for high volume, low latency Alerts & Endpoint Events via the Data Forwarder.Highlights of the features in this app:.For the full list of features available in the current version of the app, view the details on SplunkBase.What features are included with the new Splunk app?.

Splunk cim