Carbon Black EDR (Endpoint Detection and Response) is the new name for the product formerly called CB Response.
EDR 4.2+ supports a rich array of asynchronous server-side notifications, referred to as the “message bus”. This interface provides a “push” notification service so that your application can receive and process any event that is received or generated by the Carbon Black server. These events include:
The message bus enables you to build applications that can:
By default, CB publishes the
watchlist.* events over the bus (see the
for more information).
If you want to capture raw sensor events or the
binaryinfo.* notifications, you have to enable those features in
/etc/cb/cb.confto enable broadcast of the raw sensor events you wish to export.
/etc/cb/cb.confand set it to
By Default the Message Bus listens on port 5004. Ensure firewall rules allow for incoming and outgoing TCP connections to this port.
Note on enabling Raw Sensor Events
We have seen a performance impact when exporting all raw sensor events onto the enterprise bus. We do not recommend exporting all the events. The performance impacts are seen when the events are broadcast on the bus, by enabling the “DatastoreBroadcastEventTypes”. We recommend that at most, only process and netconn events be broadcast on the event bus.
Carbon Black needs to be restarted if any variables were changed in
/etc/cb/cb.conf by executing
service cb-enterprise restart.
If you are configuring the cb-event-forwarder on a Carbon Black cluster, the
must be distributed to the
/etc/cb/cb.conf configuration file on all minion nodes and the cluster restarted using
/usr/share/cb/cbcluster restart command.
It’s highly recommended to start with the Event Forwarder when working with the message bus.