Hi, This is the Carbon Black Developer Relations team. I wanted to post an update here. This app was created with the Splunk Add on builder, so there isn't much we can try. We are in the process of communicating with our Splunk contacts and investigating this issue. We are going to try recreating the App with the Add on builder and see if that fixes the issues. Can we get some input on what versions of Splunk are being used? ... View more

Hi @TonyLeeVT, the fields you're referencing are from Cb Protection (the former Bit9 product), but you're using the Cb Response App for Splunk. You want the Cb Protection App for Splunk which is available here: https://splunkbase.splunk.com/app/1790/ Hope this helps! ... View more

Unfortunately, there isn't a more fine grained filter mechanism other than to filter by event type at this time. ... View more

Your configuration file is in line with what I would expect- that does look like it will eliminate all event types except for the process start, netconn, and process block event types. Just to make sure- you only see those event types in the Splunk console as well? In that case, you may just have a very noisy environment (either lots of network connections, or Mac/Linux endpoints which create a lot more process events than Windows workstations). There's nothing else built in to the event forwarder to perform additional filtering, so you would have to trim more event types (you can use Splunk to determine the relative ranking of which event types are more prevalent in your environment). ... View more

How many endpoints do you have on your network? I would start with just feed/watchlist/alert hits in your situation, then add in process starts after you have a few days under your belt to determine volume. That said, 1GB in 6 minutes still sounds very high. Can you share your cb-event-forwarder.conf file (eliminate any credentials from the file before posting) Thanks - Jason ... View more

We haven't seen that error in the past - we use the Splunk Password Storage REST API endpoints to store the credentials in an encrypted manner. Can you send us an email at dev-support@carbonblack.com and we can set up a shared session to try and troubleshoot what may be occurring? Thanks - Jason ... View more

Note that https://splunkbase.splunk.com/app/2790/ is the TA for Cb Response, not Cb Protection. If you're integrating with Cb Protection, you want the Cb Protection App for Splunk. Sorry about the confusion. ... View more

I will have to ask our Splunk contacts to find out if this is the right mapping. We don't publish the Splunk Add-On (TA), just the Splunk App for Cb Response (DA-ESS-CbResponse). Since Cb tracks benign as well as malicious files, I don't know if automatically mapping all md5s to Malware.file_hash would break other pieces of Enterprise Security. ... View more