Carbon Black EDR (Endpoint Detection and Response) is the new name for the product formerly called CB Response.
EDR 4.2+ supports a rich array of asynchronous server-side notifications, referred to as the “message bus”. This interface provides a “push” notification service so that your application can receive and process any event that is received or generated by the Carbon Black server. These events include:
The message bus enables you to build applications that can:
By default, CB publishes the feed.*
and watchlist.*
events over the bus (see the
Events documentation
for more information).
If you want to capture raw sensor events or the binaryinfo.*
notifications, you have to enable those features in
/etc/cb/cb.conf
:
DatastoreBroadcastEventTypes
option in
/etc/cb/cb.conf
to enable broadcast of the raw sensor events you wish to export.EnableSolrBinaryInfoNotifications
option in
/etc/cb/cb.conf
and set it to True
.By Default the Message Bus listens on port 5004. Ensure firewall rules allow for incoming and outgoing TCP connections to this port.
Note on enabling Raw Sensor Events
We have seen a performance impact when exporting all raw sensor events onto the enterprise bus. We do not recommend exporting all the events. The performance impacts are seen when the events are broadcast on the bus, by enabling the “DatastoreBroadcastEventTypes”. We recommend that at most, only process and netconn events be broadcast on the event bus.
Carbon Black needs to be restarted if any variables were changed in /etc/cb/cb.conf
by executing
service cb-enterprise restart
.
If you are configuring the cb-event-forwarder on a Carbon Black cluster, the DatastoreBroadcastEventTypes
and/or
EnableSolrBinaryInfoNotifications
settings
must be distributed to the /etc/cb/cb.conf
configuration file on all minion nodes and the cluster restarted using
the /usr/share/cb/cbcluster restart
command.
It’s highly recommended to start with the Event Forwarder when working with the message bus. We also provide a quick start video guide to setting up the event forwarder.
If the event forwarder does not provide the flexibility or output options you require, then continue to our Message Bus API reference.