Event Forwarder Configuration API

Overview

This API allows you to forward events from the Carbon Black EDR or Hosted EDR to another location, such as an AWS S3 bucket.

Requirements

Carbon Black EDR or Carbon Black Hosted EDR
AWS S3 bucket or other place to send the event data

Getting Started

Configuring an AWS S3 bucket

See here for instructions on configuring an AWS S3 bucket.

API Calls

Settings

/api/v1/event_forwarder/settings

Supports: GET, POST

GET

GET request retrieves the current settings of the Event Forwarder. This is a list of all enabled settings.

Example:

  {
     "bridge": {
        "output_type": "s3",
        "output_format": "json",
        "s3out": "cb-30322",
        "syslogout": "",
        "httpout": "",
        "splunkout": "",
        "compress_data": false,
        "audit_log": false,
        "run_metrics": 1,
        "Events_raw_sensor":[ 
           "ingress.event.process",
           "ingress.event.procstart",
           "ingress.event.netconn",
           "ingress.event.procend",
           "ingress.event.childproc",
           "ingress.event.moduleload",
           "ingress.event.module",
           "ingress.event.filemod",
           "ingress.event.regmod",
           "ingress.event.tamper",
           "ingress.event.crossprocopen",
           "ingress.event.remotethread",
           "ingress.event.processblock",
           "ingress.event.emetmitigation"
        ],
        "events_watchlist": [
           "watchlist.hit.binary",
           "watchlist.hit.process",
           "watchlist.storage.hit.binary",
           "watchlist.storage.hit.process"
        ],
        "events_feed": [
           "feed.ingress.hit.binary",
           "feed.ingress.hit.host",
           "feed.ingress.hit.process",
           "feed.query.hit.binary",
           "feed.query.hit.process",
           "feed.storage.hit.binary",
           "feed.storage.hit.process"
        ],
        "events_alert": [         
           "alert.watchlist.hit.ingress.binary",         
           "alert.watchlist.hit.ingress.host",         
           "alert.watchlist.hit.ingress.process",         
           "alert.watchlist.hit.query.binary",         
           "alert.watchlist.hit.query.process"
        ],
        "events_binary_observed": [
           "binaryinfo.group.observed",
           "binaryinfo.host.observed",
           "binaryinfo.observed"
        ],
        "events_binary_upload": [
           "binarystore.file.added"
        ],
        "events_storage_partition": []
    },
    "s3": {
        "bundle_send_timeout": 60,
        "bundle_size_max": 10485760,
        "upload_empty_files": false,
        "acl_policy": "bucket-owner-full-control",
        "credential_profile": "default",
        "object_prefix": "xb3-77",
        "use_dual_stack": true
    },
    "syslog": {
        "ca_cert": false,
        "client_cert": false,
        "tls_verify": true
    },
    "http": {
        "ca_cert": false,
        "client_cert": false,
        "bundle_send_timeout": 60,
        "upload_empty_files": true,          
        "bundle_size_max": 10485760,
        "http_post_template": "{\"filename\": \"{{.FileName}}\", \"service\": \"carbonblack\","alerts\":[{{range .Events}}{{.EventText}}{{end}}]}",
        "content_type": "application/json",
        "tls_verify": true,
        "event_text_as_json_byte_array": false,
        "compress_http_payload": false
    },
    "splunk": {
        "ca_cert": false,
        "client_cert": false,
        "tls_verify": true,
        "bundle_send_timeout": 60,          
        "upload_empty_files": false,
        "bundle_size_max": 10485760,
        "hec_token": ""
    }

POST

POST request allows users to modify the Event Forwarder settings.

Specify the output type in the output_type field. The possible values for output_type are Splunk (the default destination), s3, http and syslog.

Splunk

Example for setting output to Splunk:

{
   "bridge":{
      "events_raw_sensor":[         
        "ingress.event.process",         
        "ingress.event.procstart",         
        "ingress.event.netconn",         
        "ingress.event.procend",         
        "ingress.event.childproc",         
        "ingress.event.moduleload",         
        "ingress.event.module",         
        "ingress.event.filemod",         
        "ingress.event.regmod",         
        "ingress.event.tamper",         
        "ingress.event.crossprocopen",         
        "ingress.event.remotethread",
        "ingress.event.processblock",
        "ingress.event.emetmitigation"
      ],      
      "events_watchlist":[
        "watchlist.hit.process",         
        "watchlist.hit.binary",         
        "watchlist.storage.hit.process",         
        "watchlist.storage.hit.binary"      
       ],      
      "events_feed":[         
        "feed.ingress.hit.process",         
        "feed.ingress.hit.binary",         
        "feed.ingress.hit.host",
        "feed.storage.hit.process",         
        "feed.storage.hit.binary",         
        "feed.query.hit.process",         
        "feed.query.hit.binary"      
       ],      
     "events_binary_observed":[         
        "binaryinfo.observed",         
        "binaryinfo.host.observed",         
        "binaryinfo.group.observed"      
       ],      
     "events_binary_upload":[         
        "binarystore.file.added"      
       ],      
     "events_alert":[         
        "alert.watchlist.hit.ingress.process",         
        "alert.watchlist.hit.ingress.binary",         
        "alert.watchlist.hit.ingress.host",         
        "alert.watchlist.hit.query.process",         
        "alert.watchlist.hit.query.binary"      
       ],      
    "output_format":"json",      
    "output_type":"splunk",      
    "splunkout":"splunk.server.url"
   },   
   "splunk":{      
     "hec_token":"HECTOKEN",      
     "server_cname":null,      
     "bundle_send_timeout":60,      
     "bundle_size_max":10485760,      
     "ca_cert":false,      
     "client_cert":false,      
     "tls_verify":true   
     }
   }

S3

Example for setting output to an S3 bucket:

 {
   "bridge":{
     "events_raw_sensor":[
       "ingress.event.process"
      ],
     "events_watchlist":[
       "watchlist.hit.process",
       "watchlist.hit.binary",
       "watchlist.storage.hit.process",
       "watchlist.storage.hit.binary"
      ],
     "events_feed":[
       "feed.ingress.hit.process",
       "feed.ingress.hit.binary",
       "feed.ingress.hit.host",
       "feed.storage.hit.process",
       "feed.storage.hit.binary",
       "feed.query.hit.process",
       "feed.query.hit.binary"
      ],
     "events_binary_observed":[
       "binaryinfo.observed",
       "binaryinfo.host.observed",
       "binaryinfo.group.observed"
      ],
     "events_binary_upload":[
       "binarystore.file.added"
      ],
     "events_alert":[
       "alert.watchlist.hit.ingress.process",
       "alert.watchlist.hit.ingress.binary",
       "alert.watchlist.hit.ingress.host",
       "alert.watchlist.hit.query.process",
       "alert.watchlist.hit.query.binary"
      ],
     "output_format":"json",
     "output_type":"s3",
     "s3out":"cb-30322"
   },
  "s3":{
    "bundle_send_timeout":60,
    "bundle_size_max":10485760,
    "server_side_encryption":false,
    "acl_policy":"bucket-owner-full-control",
    "credential_profile":"default",
    "use_dual_stack":true,"object_prefix":"xb3-77"   
    }
  }

HTTP

Example for setting up an http connection:

{   
  "bridge": {       
    "events_raw_sensor": [           
      "ingress.event.netconn",           
      "ingress.event.regmod"       
      ],       
    "events_watchlist": [           
      "watchlist.hit.process",           
      "watchlist.hit.binary",           
      "watchlist.storage.hit.process",           
      "watchlist.storage.hit.binary"       
      ],       
    "events_feed": [           
      "feed.ingress.hit.process",           
      "feed.ingress.hit.binary",           
      "feed.ingress.hit.host",           
      "feed.storage.hit.process",           
      "feed.storage.hit.binary",           
      "feed.query.hit.process",           
      "feed.query.hit.binary"       
      ],       
    "events_binary_observed": [           
    "binaryinfo.observed",           
    "binaryinfo.host.observed",           
    "binaryinfo.group.observed"       
    ],       
  "events_binary_upload": [           
    "binarystore.file.added"       
    ],       
  "events_alert": [
    "alert.watchlist.hit.ingress.process",           
    "alert.watchlist.hit.ingress.binary",
    "alert.watchlist.hit.ingress.host",           
    "alert.watchlist.hit.query.process",           
    "alert.watchlist.hit.query.binary"       
    ],       
  "output_format": "json",       
  "output_type": "http",       
  "httpout": "https://some.server"   
  },   
  "http": {       
    "server_cname": "serverCN",       
    "bundle_send_timeout": 60,       
    "bundle_size_max": 10485760,       
    "http_post_template": "{\"filename\": \"{{.FileName}}\", \"service\":\"carbonblack\",
    \"alerts\":[{{range .Events}}{{.EventText}}{{end}}]}",
    "content_type": "application/json",       
    "authorization_token": "AUTHTOKEN",       
    "oauth_jwt_client_email": null,       
    "oauth_jwt_private_key": null,       
    "oauth_jwt_token_url": null,       
    "oauth_jwt_private_key_id": null,       
    "oauth_jwt_scopes": null,       
    "event_text_as_json_byte_array": false,       
    "compress_http_payload": false,       
    "ca_cert": true,       
    "client_cert": true,       
    "tls_verify": true   
  }
}

Syslog

Example for setting up a Syslog:

"bridge": {     
  "events_raw_sensor": [         
    "ingress.event.process"     
  ],     
  "events_watchlist": [         
    "watchlist.hit.process",         
    "watchlist.hit.binary",         
    "watchlist.storage.hit.process",         
    "watchlist.storage.hit.binary"     
    ],     
  "events_feed": [         
    "feed.ingress.hit.process",         
    "feed.ingress.hit.binary",         
    "feed.ingress.hit.host",         
    "feed.storage.hit.process",         
    "feed.storage.hit.binary",         
    "feed.query.hit.process",
    "feed.query.hit.binary"     
  ],     
  "events_binary_observed": [         
    "binaryinfo.observed",         
    "binaryinfo.host.observed",         
    "binaryinfo.group.observed"    
  ],     
  "events_binary_upload": [         
    "binarystore.file.added"     
  ],     
  "events_alert": [         
    "alert.watchlist.hit.ingress.process",         
    "alert.watchlist.hit.ingress.binary",         
    "alert.watchlist.hit.ingress.host",         
    "alert.watchlist.hit.query.process",         
    "alert.watchlist.hit.query.binary"     
  ],     
  "output_format": "json",     
  "output_type": "syslog",     
  "syslogout": "tcp+tls://fqdn:port"
},
  "syslog": {     
    "server_cname": "serverCommonName",     
    "ca_cert": true,     
    "client_cert": true,     
    "tls_verify": true
}

Control

/api/v1/event_forwarder/control

Supports: GET, POST

GET

GET request displays the current state of the Event Forwarder. Different states are Running,Stopped, and Unknown.

Example:

{   
  "state": "RUNNING",   
  "error": false,   
  "error_text": []
}

POST

Controls Start and Stop of the Event Forwarder

Example to start the service:

{"action":"START"}

Use “STOP” to terminate the service.

AWS Credentials

/api/v1/event_forwarder/aws_credentials

Supports: POST

POST

POST request uploads new AWS credentials for the S3 bucket. This request will replace any existing S3 bucket setup. To use this endpoint, output_type in the Settings endpoint should be set to S3. The credential profile names must match in both the endpoints. If the credential_profile is not ‘default’, it must be set in the Settings POST API. Refer to this section.

Example:

{"credentials":"[default]\r\naws_access_key_id = NOTREALKEY\r\naws_secret_access_key= NOTREALKEY"}

CA Certificate

/api/v1/event_forwarder/ca_certificate

Supports: POST

POST

POST request establishes a secure connection using a specified certificate authority. To use this endpoint, output_type in the Settings endpoint should be set to Splunk, http or syslog.

Example:

{   
  "ca_cert": "-----BEGINCERTIFICATE-----\nMIIFxDCCA6ygAwIBAgIJAMSEguxuiuvvMA0GCSqGSIb3DQEBCwUAMHcxCzAJBgNV\nBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHV2FsdGhhbTEbMBkGA1UECgwS\nQ2FyYm9uQmxhY2tUZXN0aW5nMSwwKgYDVQQDDCNyZWw3MDAtemVzdGVwLWNlbnRv\ncy03LTQtc3RhbmRhbG9uZTAeFw0xOTExMTgxODIxNTVaFw0yMDExMTcxODIxNTVa\nMHcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHV2FsdGhhbTEb\nMBkGA1UECgwSQ2FyYm9uQmxhY2tUZXN0aW5nMSwwKgYDVQQDDCNyZWw3MDAtemVz\ndGVwLWNlbnRvcy03LTQtc3RhbmRhbG9uZTCCAiIwDQYJKoZIhvcNAQEBBQADggIP\nADCCAgoCggIBALc4yHQvNCWBb6qZI6vXGw9a8i51YDvHfvuOr2Wi8xokhSCi3IVC\n3uBWrlApAZv1mraJkCjLCrWyw02dsIk/dexUKxp9kd7cN1vobDEo3mJgBE8nq8KS\nNv9jra1LskxzcDTRLMRL6tT0I0p045V9b33Rlk84sXwK6ZdbcFItkYgeyRTpUts+\nzf7uAnl2Sfy6O3r3JprQPFW7TQnbHf+FfkKQyKlEg2VxLq7rkOTzqgf0U66UNvSG\nO6RKt6+Vh1bveaZg1UbhW2VQ30X0kcfb0XUskvRqeh0z5KG/9DvOJ4x/o5kTULrM\nOho7gS+YxneNS4IMKG0nGCqiDi4yMM7aVWGW758l5agQkYweLyjgyPxjls2//1GZ\nI2YmHhXjibECDAlWxqXcgDllt28C6bv/DLeqh5n8vKL/ICvbBsDnxIaiwBNutxfG\n0L6TFTGZHvEbmA2FsMOKaUc5tRWu8L8KD/8SFmURw+URK3R/jI/dGlQqzEfOl6Gx\ndXEMEblw+1I+G/nXigfSHmPMe0VRDPMKOcQzo49FpuHp9DNtedL416GnPds//S/S\nzJq5aNIO4j/9sKT76FXezuoaWN0/8Pq9jCLr62iDL5oSdQuW2mTVdb8vKIFOCVKp\nhCk/5S30MqgSCVokINoOZ+7yIo6lW3VAto15573htZ1ZpTQG/Gxl6UtvAgMBAAGj\nUzBRMB0GA1UdDgQWBBSjSQsJ2F9WoOlIbSGdUaawCfGSZTAfBgNVHSMEGDAWgBSj\nSQsJ2F9WoOlIbSGdUaawCfGSZTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB\nCwUAA4ICAQBVPlSfKLlDy9P079XCg9t/GYybV7ztzD662ySRTqJ9GMJqWTw3JkWu\n2MYA7u5bSFjXkWzh5dm84aGepFyLm3L8H1U+FmtgToLxfX+6yz4Up+R6z2ZhGRi0\nYjzmekJIxeOhgtKXW4YmbKoYMsUqkFmSuSM+UxA7Q1JX/OkMBb75WylYMzBFOuKl\nk66C+x9PowMaqwcyEbcgAggkqG82Pd/nIj0bkhUFmngWTX95ItRqB2kTLtDwr1Mg\nQ5GtmwMwv66nCmUn1/HlB9He0KcLz/4rUln/0vqoz9Khio9LVdGgxYYtFBjssQ3Z\ny4aHSpVYOt/NiKZxc32sdYVom+Ii21/WOfNNz9H6p1dxG8j4t8C4jkGMbooyur0G\nZdy7QjQUkC9bRjFYEMh6w+LyBCM/y6FaTg6YpcbB/0syIhm39QuPPdIyxH8XS79I\n0fktAkXsiJCfpFSakHLfOeLaIHOCDPgeI97ErkDG5ghn/rjgJ9uDI0k0tKCk0p2l\nSNCDqZ/gj0eINKb0y7ahl2lky5yXlRF7AW0KlVbRUowmT1kLsAQIAxkjRzgN/G52\n+LAXaQY9z1z
VZLPhtVJEqZ7oomHygWcgRKEvGRr9NW2VmCPWSl6hi2qVPFpcL7bP\nFkXbtkPK8hcwW5DQSNeGMwHjGilzziKanRTRzxJLGkDBMHjHBy48Hw==\n-----ENDCERTIFICATE-----\n"
}

Please note: This is an example certificate.

TLS Certificate

/api/v1/event_forwarder/client_certificate_and_key

Supports: POST

POST

Similar to the CA certificate, this POST request sets up the value key pair for a TLS certificate.To use this endpoint, output_type in the Settings endpoint should be set to Splunk, http orsyslog.

Example:

{   
  "client_cert": "-----BEGINCERTIFICATE-----\nMIIFxDCCA6ygAwIBAgIJAMSEguxuiuvvMA0GCSqGSIb3DQEBCwUAMHcxCzAJBgNV\nBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHV2FsdGhhbTEbMBkGA1UECgwS\nQ2FyYm9uQmxhY2tUZXN0aW5nMSwwKgYDVQQDDCNyZWw3MDAtemVzdGVwLWNlbnRv\ncy03LTQtc3RhbmRhbG9uZTAeFw0xOTExMTgxODIxNTVaFw0yMDExMTcxODIxNTVa\nMHcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHV2FsdGhhbTEb\nMBkGA1UECgwSQ2FyYm9uQmxhY2tUZXN0aW5nMSwwKgYDVQQDDCNyZWw3MDAtemVz\ndGVwLWNlbnRvcy03LTQtc3RhbmRhbG9uZTCCAiIwDQYJKoZIhvcNAQEBBQADggIP\nADCCAgoCggIBALc4yHQvNCWBb6qZI6vXGw9a8i51YDvHfvuOr2Wi8xokhSCi3IVC\n3uBWrlApAZv1mraJkCjLCrWyw02dsIk/dexUKxp9kd7cN1vobDEo3mJgBE8nq8KS\nNv9jra1LskxzcDTRLMRL6tT0I0p045V9b33Rlk84sXwK6ZdbcFItkYgeyRTpUts+\nzf7uAnl2Sfy6O3r3JprQPFW7TQnbHf+FfkKQyKlEg2VxLq7rkOTzqgf0U66UNvSG\nO6RKt6+Vh1bveaZg1UbhW2VQ30X0kcfb0XUskvRqeh0z5KG/9DvOJ4x/o5kTULrM\nOho7gS+YxneNS4IMKG0nGCqiDi4yMM7aVWGW758l5agQkYweLyjgyPxjls2//1GZ\nI2YmHhXjibECDAlWxqXcgDllt28C6bv/DLeqh5n8vKL/ICvbBsDnxIaiwBNutxfG\n0L6TFTGZHvEbmA2FsMOKaUc5tRWu8L8KD/8SFmURw+URK3R/jI/dGlQqzEfOl6Gx\ndXEMEblw+1I+G/nXigfSHmPMe0VRDPMKOcQzo49FpuHp9DNtedL416GnPds//S/S\nzJq5aNIO4j/9sKT76FXezuoaWN0/8Pq9jCLr62iDL5oSdQuW2mTVdb8vKIFOCVKp\nhCk/5S30MqgSCVokINoOZ+7yIo6lW3VAto15573htZ1ZpTQG/Gxl6UtvAgMBAAGj\nUzBRMB0GA1UdDgQWBBSjSQsJ2F9WoOlIbSGdUaawCfGSZTAfBgNVHSMEGDAWgBSj\nSQsJ2F9WoOlIbSGdUaawCfGSZTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB\nCwUAA4ICAQBVPlSfKLlDy9P079XCg9t/GYybV7ztzD662ySRTqJ9GMJqWTw3JkWu\n2MYA7u5bSFjXkWzh5dm84aGepFyLm3L8H1U+FmtgToLxfX+6yz4Up+R6z2ZhGRi0\nYjzmekJIxeOhgtKXW4YmbKoYMsUqkFmSuSM+UxA7Q1JX/OkMBb75WylYMzBFOuKl\nk66C+x9PowMaqwcyEbcgAggkqG82Pd/nIj0bkhUFmngWTX95ItRqB2kTLtDwr1Mg\nQ5GtmwMwv66nCmUn1/HlB9He0KcLz/4rUln/0vqoz9Khio9LVdGgxYYtFBjssQ3Z\ny4aHSpVYOt/NiKZxc32sdYVom+Ii21/WOfNNz9H6p1dxG8j4t8C4jkGMbooyur0G\nZdy7QjQUkC9bRjFYEMh6w+LyBCM/y6FaTg6YpcbB/0syIhm39QuPPdIyxH8XS79I\n0fktAkXsiJCfpFSakHLfOeLaIHOCDPgeI97ErkDG5ghn/rjgJ9uDI0k0tKCk0p2l\nSNCDqZ/gj0eINKb0y7ahl2lky5yXlRF7AW0KlVbRUowmT1kLsAQIAxkjRzgN/G52\n+LAXaQY9z1zVZLPhtVJEqZ7oomHygWcgRKEvGRr9NW2VmCPWSl6hi2qVPFpcL7bP\nFkXbtkPK8hcwW5DQSNeGMwHjGilzziKanRTRzxJLGkDBMHjHBy48Hw==\n-----ENDCERTIFICATE-----\n",   
     "client_key": "-----BEGIN PRIVATEKEY-----\nMIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC3OMh0LzQlgW+q\nmSOr1xsPWvIudWA7x377jq9lovMaJIUgotyFQt7gVq5QKQGb9Zq2iZAoywq1ssNN\nnbCJP3XsVCsafZHe3Ddb6GwxKN5iYARPJ6vCkjb/Y62tS7JMc3A00SzES+rU9CNK\ndOOVfW990ZZPOLF8CumXW3BSLZGIHskU6VLbPs3+7gJ5dkn8ujt69yaa0DxVu00J\n2x3/hX5CkMipRINlcS6u65Dk86oH9FOulDb0hjukSrevlYdW73mmYNVG4VtlUN9F\n9JHH29F1LJL0anodM+Shv/Q7zieMf6OZE1C6zDoaO4EvmMZ3jUuCDChtJxgqog4u\nMjDO2lVhlu+fJeWoEJGMHi8o4Mj8Y5bNv/9RmSNmJh4V44mxAgwJVsal3IA5Zbdv\nAum7/wy3qoeZ/Lyi/yAr2wbA58SGosATbrcXxtC+kxUxmR7xG5gNhbDDimlHObUV\nrvC/Cg//EhZlEcPlESt0f4yP3RpUKsxHzpehsXVxDBG5cPtSPhv514oH0h5jzHtF\nUQzzCjnEM6OPRabh6fQzbXnS+Nehpz3bP/0v0syauWjSDuI//bCk++hV3s7qGljd\nP/D6vYwi6+togy+aEnULltpk1XW/LyiBTglSqYQpP+Ut9DKoEglaJCDaDmfu8iKO\npVt1QLaNeee94bWdWaU0BvxsZelLbwIDAQABAoICABCvSxHJeqYvs0uFxonPfNdZ\nINS6O5k2AYpG5BINVLX8vWLLcelwvXsQaa9DDLJ3Gy+kN0x/sOn67W4T/g+Bh+uN\nfp9a7/2rcB8eezu+zQGIXNwYcLu3NOrs2NP/IK11lbI5mioF/8yErvII0vC6C30Z\nqOZt8zuogr0VxpS1MZuDsiwFU1ZD0d51LiSBcRtimigIeat/av8jn1BWc9ThAy5s\noNlJM+348JddPESdK86toTE0rgx2bNf5NeD3bOutwxYzmzhpLTl8s9ha/SuGCPzy\noi8/wv8FyrwwDr2jeFaDCRLXf3KDRoc9A/ahovEgHNAq60OFW94GA+SRDYDIwR2K\nfnOmCDe+OmbYxgij9yQxAPBZMVAQ2zMS0VTPNZMbC92ZFoOypxCnVyxEME/bfVO7\nzInts7TLlOzqiXcpHuwpcfhJBQwtk3slkpSti71ASxxr518ouZMfIb5GGYqOrZ7O\nPjdpPxAS0aRHPqbtxol2Pda3C4NdDJEvfmo5CacorGFP6TZnelTBwtyfAd3YF+UC\nuB3JP19WaWTLt20IpmvcbbSG3sGVnpaK4m6LjMLffwI4/O0bnA1gy/BZUH0ba7dc\nsuNN0n9nlIS3XjsA1o41Di++rymBP6DfO52kfCkp8XcnPfQn8q9mAPFl0u4zOM0W\nO79/hXfXGheXGzq7lnYBAoIBAQDbd4RFUD4zt+Gr15xmXLF4E6oAsYB9GE3S0TcP\nFHeTzL+XIsgZFqmB23ALXnxjb24flGj+RixedJLj4qrn2MPrkgW+XmzF6G7R1N4Y\n8EKzX8FRkwXXiKCGfRYRrekZ4CdxnhCL5+s1t5nzTteUrCXZuEu60Pi4/eeHlBTE\nrk30ftiGvPQkHtYwypIIvkPaj+6Gxjoi5dFgJmF0YbcLI6Zq6eG9UQQTTRwuXIXK\nq/QshIVbJmCyBZYkLv0hU5xEtqT7e9ZETpOUSCFw4GT9tfAlu1cT+EpDMWD927iy\nKFNZcwAF9Jiq5VXPYiFYOjRVeu7vhxGbvigk6S+lP+5kah0RAoIBAQDVuLMMr5bi\nP7X6XlnyiiQi4nspnQib5zzJKNqwUs8F+DnAJmgCF79Qpk7Hpdd3XB6ZWeUPCTry\nnNH0HzV1tVBtIv99rC1LC6BaZlIfZHAfHEyWyNklzkxq8hq7H84JOu5z/Ix7SWN4\njEHNUQPuoVhSIzbkUukeN8jUHzMcAYMohK4r+WrQSHcggskqLIDGaMIAuD/NFc0H\ntrDPY+qCfOG4JJO83pivtIGRhr74OysIryNnJIb/GI5vPmqIRe4W/z0QQOaiJcbr\nIhefVH4qulvsEa1zFBz4zjrsZY9Vhfh9yyb0xjCp6Iu5CutLklMvkLXqxVEx2aFH\nLrCZNTT2duB/AoIBACYMaHAj40TQIl3KeaD9fP8WWajZHS+S4Rsljmgc4kZLfwPS\n0eIXnbeXtasi7GnIzczHzBQZUmPlzfmYOI0NdZoHrNs+P5loHJ5gS0kDjmzOsxNT\na/XcCAiI8ySJhBoqVGxMPQ4kXRDpDdWy24k49y7x1p9Cz3wy+Mr2j0sx9O3od92U\nMLd6aSP4Wq0NX3Iq9e2DvFyEf3It9UNaFYPm4Fk0xyAtRYmbGsGm5MMoYKK/LueI\nlccHVOpdAyGd/z+icqPu6kzZWpigkLujC584xbOk8QnTR/yyOOCKEVFB0IF3gI+H\nwlgOfnv/xUwoex4+u+HnBtR7eTY8/zelB8184CECggEBALeV+PgkvQ+Met2evtVB\nJNlygymz4vlJIUYK+hAMkhkmqTUNyLpDe+vjcDi/lN7LGt3QAptv6lsNqqxxQpLi\nNTwKnD1v8VhNnGkLC/A7brTKsl+0GBQJqksTvTKQl4QGQ18Oyf39hJzAnqWnuiD6\nJ8wmw7hOIEH82V6djmG4Sto7XwIXNlHEbdBXiEXaBKRqyHulyeh5ma3OmQMNaRy9\n+YccpGvRKoeEHujLPrAs40KKb3biQbRPe8rDau+0YlkO131mwrb2jHDe0DvlcJtz\nihK2/K+lz11KigMXGpD0jAhCwivxM0xAngVOA+DeyOZLAHmzFZQkxg1HZhu1QNGW\nPDECggEAJI5rjLHOg4c4fEpkXZg48BVYYkE15iSBAN5sFRNhSjtnOLV+k4dtpp9b\nOha9c+cJUKodnVS+FRxHlYVR7tydqKyzTQeuDNwx8uVxr9XqVGdXdTgUh8tWz8Mo\ntO9s3oPc5/On96fxTZTI0PLhg2dJcIcIo55mF9sGY0TAvf/TkKAq6guH5zHieDcx\nwoPJQW8DUdSUTkM9yrPr0jTeDLzCPURGaiNtdUZKTNSPWt+Ax9cpsILc+i5CBGam\nVjpCHBku1KZ0iEnxod02R67KTj6qv8Q9RKcTgXdd4gz++d/UI3nCUFnkPELa0CFY\nRHeA1VWlxzXjrvxZ+Tl4TS+F3qZsWw==\n-----END PRIVATE KEY-----\n"
}

Please note: This is an example of a key value pair.

Last modified on June 14, 2020

Carbon Black EDR

API Reference

Page Contents

Event Forwarder Configuration API

Overview

Requirements

Getting Started

Configuring an AWS S3 bucket

API Calls

Settings

GET

POST

Splunk

S3

HTTP

Syslog

Control

GET

POST

AWS Credentials

POST

CA Certificate

POST

TLS Certificate

POST