Carbon Black EDR (Endpoint Detection and Response) is the new name for the product formerly called CB Response.

Quick Links:

• EDR Event Forwarder Configuration ()
• Splunk Configuration ()
• Splunk Universal Forwarder Configuration ()

In this tutorial we will learn how to configure the EDR event forwarder, the Splunk Universal Forwarder, and Splunk in order to view EDR events within the Splunk interface.

Before You Begin

What events would you like to forward from Carbon Black EDR to Splunk? By default, the Event Forwarder will send watchlist & feed hits to Splunk. Additionally, you can choose to forward any of the event types collected by EDR to your Splunk server, including process spawn events, network connections, file modifications, registry modifications, and more.

Of course, adding event types will greatly increase the event rate into Splunk. As a rough order of magnitude, the typical Windows endpoint will generate anywhere between 2-10 events per second, where each event can average between 200-500 bytes in length. If you are considering enabling several endpoint event types, it’s highly recommended to install the event forwarder on a machine separate from your Carbon Black server and also save the output for a few days to disk in order to estimate the flow size before enabling forwarding into Splunk.

Summary

On the EDR server, install the following items:

• EDR Event Forwarder - installation video, documentation, source code
• Splunk Universal Forwarder

On the Splunk server, install:

• Carbon Black TA (Technogy Add-on) - this will allow Splunk to parse the events sent via the EDR Event Forwarder (above)
• EDR, or CB Response App for Splunk - provides dashboards, workflow actions, and more to help visualize and explore Carbon Black data