Splunk Enterprise Security

What is the best Splunkbase app for Carbon Black Protection (bit9) and Splunk Enterprise Security integration?

wliu_ondeck
Explorer

We currently use Splunk Enterprise Security (ES).

When ingesting Carbon Black Protection (bit9) logs which Splunkbase app is best to use? What have been people's experiences?

Should I go for the Cb Protection App for Splunk built by Carbon Black? Or should I go for the Splunk Add-on for Bit9 Carbon Black built by Splunk?

I just need the data parsed and tagged correctly to the CIM data models.

*As clarification Parity aka Bit9 aka Carbon Black Protection are the same product.

0 Karma

carbonblack
Path Finder

Note that https://splunkbase.splunk.com/app/2790/ is the TA for Cb Response, not Cb Protection. If you're integrating with Cb Protection, you want the Cb Protection App for Splunk. Sorry about the confusion.

rpille_splunk
Splunk Employee
Splunk Employee

Use https://splunkbase.splunk.com/app/2790/, as it is CIM compatible.

0 Karma

robjackson
Path Finder
0 Karma

ravichandren
New Member

As per Carbon black, TA is applicable for CB response product and not for the protection. We have a CB protection V7.2 so what is the TA we suppose to use get those logs CIM complaint. Thanks!!

0 Karma

wliu_ondeck
Explorer

Your clicking on the link which inserts an extra , comma at the end. Take out the comma at the end and it will work.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!