Splunk Enterprise Security

What is the best Splunkbase app for Carbon Black Protection (bit9) and Splunk Enterprise Security integration?

wliu_ondeck
Explorer

We currently use Splunk Enterprise Security (ES).

When ingesting Carbon Black Protection (bit9) logs which Splunkbase app is best to use? What have been people's experiences?

Should I go for the Cb Protection App for Splunk built by Carbon Black? Or should I go for the Splunk Add-on for Bit9 Carbon Black built by Splunk?

I just need the data parsed and tagged correctly to the CIM data models.

*As clarification Parity aka Bit9 aka Carbon Black Protection are the same product.

0 Karma

carbonblack
Path Finder

Note that https://splunkbase.splunk.com/app/2790/ is the TA for Cb Response, not Cb Protection. If you're integrating with Cb Protection, you want the Cb Protection App for Splunk. Sorry about the confusion.

rpille_splunk
Splunk Employee
Splunk Employee

Use https://splunkbase.splunk.com/app/2790/, as it is CIM compatible.

0 Karma

robjackson
Path Finder
0 Karma

ravichandren
New Member

As per Carbon black, TA is applicable for CB response product and not for the protection. We have a CB protection V7.2 so what is the TA we suppose to use get those logs CIM complaint. Thanks!!

0 Karma

wliu_ondeck
Explorer

Your clicking on the link which inserts an extra , comma at the end. Take out the comma at the end and it will work.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...