Steps to install and configure settings in the app
Various actions you can use once it is configured
Installation Guide
Install the Carbon Black Cloud app for Splunk SOAR.
• Open your Splunk SOAR console, go to Apps.
• Navigate to the New Apps menu and find `Carbon Black Cloud`, click Install.
• Go back to Unconfigured Apps, confirm that `Carbon Black Cloud` is present in the section. Instructions to configure a new asset are in Configure Splunk SOAR section.
Data Ingestion
There are two methods of data ingestion: from Carbon Black Cloud using REST APIs and from Splunk Enterprise using the Splunk App for Splunk SOAR.
Data Ingestion from Carbon Black Cloud
Data is ingested from Carbon Black Cloud using REST APIs.
Note: For VMware Carbon Black Cloud customers who use VMware Cloud Services Platform for Identity and Access Management, OAuth App Id and OAuth App Secret can be used.
• Open your Carbon Black Cloud console, go to Settings > API Access, select "Access Levels" and click "Add Access Level".
• Fill in the "Name" and "Description" fields, grant the new Access Level with the following RBAC permissions and click Save.
_Note: Refer to the SOAR actions table to determine permissions for the actions you want to enable._
• Go to the "API Keys" tab and click "Add API Key".
• Enter a "Name", click on the "Access Level type" dropdown, select "Custom", click on the "Custom Access Level" dropdown and select the level you created in step 2, then click Save.
• Copy the API Secret Key and API ID from the pop-up modal (store the API Secret Key somewhere securely, because it cannot be retrieved after initial creation).
• Copy Carbon Black Cloud console URL(including the "https://"), and ORG KEY.
• Open the Splunk SOAR console. Go to Apps > Unconfigured Apps > Carbon Black Cloud click Configure New Asset.
• Go to "Asset Info" Tab and enter "Asset name".
• Go to "Asset Settings" Tab and add Carbon Black Cloud instance URL, Carbon Black Cloud Org Key, API ID and API Secret Key to their respective fields. Click on the corresponding checkbox to enable fetching a specific type of alerts (CB_ANALYTICS alerts, DEVICE_CONTROL alerts, WATCHLIST alerts (requires Enterprise EDR), CONTAINER_RUNTIME alerts (requires Container Security), HOST_BASED_FIREWALL, INTRUSION_DETECTION_SYSTEM (requires Enterprise EDR)). Set Minimum Alert Severity to the lowest severity to be ingested to Splunk SOAR.
• Go to "Ingest Settings" Tab and enable polling on the asset. Select a polling interval or schedule to configure polling on this asset. The suggested Polling interval is 3 minutes. Click Save.
• Go back to "Asset Settings" tab and click "Test Connectivity" to ensure successful connection.
Splunk App for Splunk SOAR
The Splunk App for Splunk SOAR is used to pull event data from Splunk Enterprise. Artifacts pulled in from Splunk Enterprise have all the Carbon Black Cloud alert data packed into a single value and lack the necessary mappings.
In order to operate on the Carbon Black Cloud events, the user needs to create a normalize artifact playbook. After the events have been processed by the playbook, all the containers ingested from Splunk Enterprise will be converted to the same format as the events ingested directly from Carbon Black Cloud with support for all the Carbon Black Cloud contextual actions.
Splunk Enterprise with Carbon Black Cloud App configured
Splunk App for Splunk SOAR
Custom Type API Key for data inputs and SOAR Actions
Setup Splunk App for Splunk SOAR
The Splunk App for Splunk SOAR is required to ingest data from Splunk into Splunk SOAR. It is available on
Splunkbase.
The following section has steps for the recommended installation method via Apps within Splunk SOAR.
• Open your Splunk SOAR console, go to Apps.
• Navigate to the New Apps menu and find `Splunk`, click Install.
• Go back to Unconfigured Apps, confirm that `Splunk` is present in the section.
For information about configuring the app refer to the README in the project documentation.
The Command for query to use with On Poll setting needs to be set to search and the Query to use with On Poll setting needs to be set to index="*carbonblackcloud". Replace carbonblackcloud if non default index is configured in Splunk Enterprise to store Carbon Black Cloud events.
Note: If using Splunk App version 2.11.0 or newer, use token authentication rather than password authentication for increased security. Follow the steps in Splunk Documentation to generate an API token.
Create Normalize Artifact Playbook and Set It Active
When Splunk App is used to ingest data from Splunk SIEM, the events data is packed in one string. In order to be able to run actions on the events, they need to be normalized (individual fields mapped within Splunk SOAR). By creating normalize artifact playbook and setting it active every new event that is ingested is normalized automatically. By default the automation user lacks artifact permissions. Before creating the playbook grant permissions to the automation user.
• Navigate to Administration > User Management > Roles & Permissions. Click "Add New Role".
• Go to Basic Permissions Section and enable delete permissions for Events by selecting the "Delete" checkbox. Click Add Users.
• Select Automation user and click Add.
• Fill in the Role Name and Role Description fields accordingly. Click Create Role.
• Go to Playbooks > Add Playbook.
• Drag and release blue node to get started. Select Action.
• Select Carbon Black Cloud from Available Apps menu.
• Select "normalize artifact" from Available Actions menu.
• Select an asset from Available Assets menu (Polling on the asset needs to be disabled).
• Normalize artifact has two input parameters that need to be mapped. Map raw to artifacts > _raw. Map artifact_id to the id field of the artifact headers. Click Save.
• Drag the blue node towards the "END" block. Enter the name of the playbook in the corresponding field.
• In the 'Operates on' dropdown in Playbook Settings section, select 'events'. Click Save.
• Enter a comment to save the playbook. Click Save.
• Navigate to the 'Playbooks' page and set the status of the created playbook to active.
Using the App
SOAR Actions
Access the SOAR actions by following the instructions below.
Note: Some SOAR actions are available as 'context actions'. For more information refer to the SOAR actions table.
• Open your Splunk SOAR console, go to Sources > New Events.
• Select an Event.
• Click Action. Select an action and the asset created during Data Ingestion configuration.
• Proceed with the input parameters and click Launch to run the action.
• Open your Splunk SOAR console, go to Sources > New Events.
• Select an Event.
• Navigate to Artifacts section and extend the view by clicking on the arrows.
• Select a parameter and click the arrow next to its value. Navigate to "Run Action" tab and select an action.
• Proceed with the input parameters and click Launch to run the action.
Details and requirements are listed below for each of the actions.
Actions
Note: The actions in *italics* are available as 'context actions'.
The Carbon Black Cloud App uses standard Splunk SOAR logging system. For details about logging, go to Logging levels for Splunk SOAR.
Multi-Tenancy
Enable multi-tenancy to allow one security team to manage multiple independent customers while segregating their customers' assets and data. For example, a Managed Security Service Provider (MSSP) business can use multi-tenancy to perform incident response for multiple clients with one analyst team on a single Splunk SOAR (On-premises) instance and maintain customer separation. The MSSP SOC can administer each customer's data set without needing a separate login and permissions configuration.
To learn how to set up your multitenant environment, follow Splunk's Multitenant management.
