@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 2.48 KB
View source Raw

CarbonBlack Integration

CarbonBlack is a cloud-based endpoint security platform that provides continuous monitoring and threat detection for endpoints. This integration allows you to ingest CarbonBlack alerts into the SOCFortress SIEM stack.

Introduction

The CarbonBlack API follows a RESTful pattern. Requests are made via resource-oriented URLs as described in this document and API responses are formatted as JSON data and ingested into the SOCFortress SIEM stack.

Use Cases

  • Poll for Alerts to ingest into a SIEM

Requirements

  • Any Carbon Black Cloud product
  • Some Alert Types are only generated by specific products

Steps

Create a custom access level.

  1. Sign in to the VMware Carbon Black Cloud UI console.
  2. In the navigation menu, click Settings > API Access.
  3. On the API ACCESS page, in the Access Levels tab, click Add Access Level.
  4. In the dialog, configure these settings:
    • Name — Enter a memorable name.
    • Description — Enter a description for the API key.
    • Permissions table — In the Alerts row, select READ for the General information permission.
      • Note: This automatically selects Custom in the Copy permissions from list.
  5. Click Save.

Configure a new API key

  1. In the navigation menu, click Settings > API Access.
  2. On the API ACCESS page, in the API Keys tab, click Add API Key.
  3. In the dialog, configure these settings:
    • Name — Enter a unique name for the API key. For example, "CoPilot API."
    • Access Level type — Select Custom.
    • Custom Access Level — Select the access level you created in Create a custom access level.
  4. Click Save.
  5. Copy the API ID and API Secret Key values, and then save them in a safe, encrypted location. You will provide them to CoPilot later.
  6. On the API Keys tab, copy the ORG Key and ORG ID values, and then save them in a safe, encrypted location. You will provide them to CoPilot later.
  7. In the URL of your VMware Carbon Black Cloud console, copy, and then save the hostname component of the base API URL for your environment. For example, https://defense.conferdeploy.net. You will provide this to CoPilot later. > Tip: See Constructing your Request for more information.