Carbon Black Cloud Threat Intelligence Connector

Posted on April 28, 2022


Overview

The Carbon Black Cloud Threat Intelligence connector allows the importing of threat intelligence data by using the STIX/TAXII standards.

This new version supports the major versions of STIX (1.2/2.0/2.1). In contrast to the previous version it is a standalone connector with improved usability and more features, rather than part of the CBC SDK.

Prerequisites

To use this connector you must have the following products:

  • Carbon Black Cloud, Enterprise EDR
  • Carbon Black Cloud Threat Intelligence Connector (GitHub)
  • Third-Party Threat Intelligence data (STIX 1.x/2.x or TAXII 1.x/2.x)

Usage

We have created a detailed guide for you to follow in order to install and use the connector. The guide is located in the developer network here.

You will learn:

  • Parsing of STIX Files (STIX 1.x / 2.x)
  • Parsing STIX data out of TAXII Servers/Services (TAXII 1.x/2.x)
  • Create Feeds in Carbon Black Cloud
  • Create Watchlists in Carbon Black Cloud
  • The mappings from STIX Objects to Carbon Black Cloud Indicator of Compromises (IOCs)
  • How it all works together
  • Installing the connector inside a Docker container with a CRON job setup
  • Known problems with STIX/TAXII
  • Helpful articles to help you understand better STIX and TAXII