Splunk CB Response - compatible with Splunk Enterprise 7.3.3

[pbrinkman]

hi,

Looking to upgrade Splunk Enterprise from 7.2.4 to 7.3.3 and wanted to know is the CB Response app (ver 2.1.4) is compatible with Enterprise 7.3.3

Looking on Splunkbase it only does'nt mention version 7.3 at all.

https://splunkbase.splunk.com/app/3336/

Does anyone know if CB Response version 2.1.4 does work on Splunk Enterprise 7.3.3 without any issues ?

Thanks
Paul

[sahidyad]

The current Splunk Active Response App version 2.1.x does not support the new Enterprise Splunk 7.3.3. However, the CB Response Eventforwarder app will be able to support the latest Splunk versions.

[pbrinkman]

hi, thanks for the information, looking at SplunkBase, there are the following apps for Carbon Black
https://splunkbase.splunk.com/apps/#/search/carbon%20black/

What one is the CB Response Eventforwarder app ?

Cheers
Paul

[sahidyad]

@pbrinkman Cb Response Eventforwarder is an app built and supported by Carbon Black. Please see https://developer.carbonblack.com/guide/enterprise-response/event-forwarder-quickstart-video/ for more information. You can forward log information to Splunk via Eventforwarder.

Please reach out to Carbon Black support for information on the Event forwarder.