In this tutorial we will learn how to configure the CB Response event forwarder, and Splunk in order to view CB Response events within the Splunk interface using the HTTP Event Collector.
What events would you like to forward from Carbon Black Enterprise Response to Splunk? By default, the Event Forwarder will send watchlist & feed hits to Splunk. Additionally, you can choose to forward any of the event types collected by CB Response to your Splunk server, including process spawn events, network connections, file modifications, registry modifications, and more.
Of course, adding event types will greatly increase the event rate into Splunk. As a rough order of magnitude, the typical Windows endpoint will generate anywhere between 2-10 events per second, where each event can average between 200-500 bytes in length. If you are considering enabling several endpoint event types, it’s highly recommended to install the event forwarder on a machine separate from your Carbon Black server and also save the output for a few days to disk in order to estimate the flow size before enabling forwarding into Splunk.
On the CB Response server, install the following items:
On the Splunk server, install:
Enable HEC input from the CB Response Server
Configure the CB Response Event Forwarder to send data to Splunk HEC
cb-event-forwarder.conf # Additional configuration options have been ommited # # Configure the specific output. # Valid options are: 'udp', 'tcp', 'file', 'stdout', 's3' # # udp - Have the events sent over a UDP socket # tcp - Have the events sent over a TCP socket # file - Output the events to a rotating file # s3 - Place in S3 bucket (not officially supported) # syslog - Send the events to a syslog server # output_type=splunk splunkout=https://<your-splunk-HEC-endpoint>:8088/services/collector/event # Configure the output format # valid options are: 'leef', 'json' # # default is 'json' # Use 'leef' for pushing events to IBM QRadar, 'json' otherwise # output_format=json [splunk] hec_token=YOURSPLUNKHECTOKEN tls_verify=false upload_empty_files=false bundle_send_timeout=60