CarbonBlackEndpointStandardEventCollector

Details

ID	`CarbonBlackEndpointStandardEventCollector`
Provider	Broadcom
Category	Endpoint
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Carbon Black Endpoint Standard Event Collector in Cortex

Parameter	Description	Required
Server URL		True
API ID	The API Key to use for connection	True
API Secret Key		True
Organization Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Include Audit Logs		False
Maximum number of alerts per fetch	Default 100,000.	False
Maximum number of audit logs per fetch	Default 25,000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

carbonblack-endpoint-standard-get-events

Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Base Command

carbonblack-endpoint-standard-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display the events. Possible values are: true, false. Default is false.	Required
alerts_limit	The maximum number of alerts to return (maximum value - 100000). Default is 10000.	Optional
audit_logs_limit	The maximum number of audit logs to return (maximum value - 25000). Default is 2500.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — API ID (required)
org_key — Organization Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
add_audit_logs — Include Audit Logs
max_alerts — Maximum number of alerts per fetch
max_audit_logs — Maximum number of audit logs per fetch

Commands (1)

carbonblack-endpoint-standard-get-events
Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Source

CarbonBlackEndpointStandardEventCollector.py CarbonBlackEndpointStandardEventCollector_test.py CarbonBlackEndpointStandardEventCollector.yml CarbonBlackEndpointStandardEventCollector_description.md command_examples.txt

Download History Raw

## Create an API Key
1. Create *access level* entry with the following **READ** permissions:
   * org.alerts.notes
   * org.xdr.metadata
   * org.alerts
   * org.alerts.tags
   * org.audits

2. Create the API key ([see documentation](https://developer.carbonblack.com/reference/carbon-black-cloud/authentication#authenticate-your-request)) with the following parameters:
    * Access Level Type = Custom
    * Custom Access Level = the name of the *access level* entry created in step 1.

## Fetching Audit Logs Important Note
* The API for audit logs sends consumable audit log entries starting from 3 days before the creation of the API Key. To fetch the latest audit logs available, it is recommended to create a new API key for this instance, as the instance will create entries for the earliest available logs first. 
* To prevent duplicate entries (in case of API key refresh) the integration instance will store the last fetched audit log entry time, and block fetches of older audit logs entries.
* It is not recommended to refresh the API key, as the integration will need time to recover to the latest audit logs available.