Splunk Integration with CB EDR

[SatyaMGS]

Hi Team,

Actually, I'm very interested to learn Splunk SIEM. I have downloaded trail version in my Home Lab Environment. I'm using Carbon Black EDR also.  I tried to integrate Carbon EDR to Splunk and check EDR logs in Splunk. But I don't know. How to integrate this. Please provide step-step process to do this integration.  Kindly needful.

Thanks

Satya

7013634534

[livehybrid]

Hi @SatyaMGS 

If you need some high level walkthroughs on how to use Splunk, including how to search, install apps etc then I would recommend checking out some of the videos at https://www.youtube.com/SplunkHowTo

In terms of setting up Carbon Black, here is what I found from other docs online that might help.

Step 1: Set Up the Carbon Black App for Splunk

1. In your Splunk web interface, go to "Apps" → "Find More Apps"
2. Search for "Carbon Black" or "VMware Carbon Black"
3. Install the appropriate app for your Carbon Black version
4. Restart Splunk after installation

Step 2: Configure Carbon Black API Credentials

1. Log into your Carbon Black EDR console
2. Navigate to the "Settings" → "API Access"
3. Create a new API key with read permissions
4. Note down the API key and API URL - you'll need these for Splunk

Step 3: Configure the Carbon Black App in Splunk

1. In Splunk, navigate to the installed Carbon Black app
2. Go to "Configuration" or "Setup" within the app
3. Enter the following details:
   • Carbon Black Server URL (e.g., https://your-cb-server.domain)
   • API Token/Key you created earlier
   • Select which data types you want to collect (events, alerts, etc.)
   • Set collection intervals

Step 4: Set Up a Data Input for Carbon Black in Splunk

1. Navigate to "Settings" → "Data inputs" in Splunk
2. Select "Carbon Black" or the corresponding input type
3. Configure a new input with:
   • Name: Something descriptive like "CarbonBlack-EDR-Logs"
   • Server URL: Your Carbon Black server address
   • API credentials
   • Log types to collect
   • Collection interval (e.g., every 5 minutes)

Step 5: Verify Data Collection

1. After configuration, wait for the collection interval to pass
2. In Splunk, run a search like: sourcetype="carbonblack:*" or index=carbonblack
3. If properly configured, you should see Carbon Black EDR logs appearing

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will