The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.
How to onboard Carbon Black Data Streaming logs to Panther
To configure Carbon Black log streaming for ingestion in Panther, you will first set up Data Forwarders in Carbon Black, then create a Carbon Black Data Streaming source in Panther.
It's recommended to configure each Data Forwarder to send logs to a different folder in your S3 bucket. This will ensure all data is parsed correctly in Panther.
When creating the Alert Data Forwarder, for Schema, select 2.0.0.
After completing this process, your Data Forwarders will look similar to the below:
Step 2: Create a new Carbon Black Data Streaming source in Panther
In the left-hand navigation bar of the Panther Console, click Configure> Log Sources.
Click Create New.
Search for "Carbon Black," then click the Carbon Black Data Streaming tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the AWS S3 Bucket option.
On the Basic Info page, click Configure Prefixes & Schemas (Optional).
For each Data Forwarder you created in Step 1 of this process, create an S3 Prefix and schema pair. If you are using all three log types, this will look like:
schema:CarbonBlack.Auditdescription:Audit logs from CarbonBlackreferenceURL:https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/fields: - name:verbosedescription:Whether the event is verbose or nottype:boolean - name:eventIddescription:The ID of the eventrequired:truetype:string - name:eventTimedescription:The time the event occurredtype:timestamptimeFormats: - unix_msisEventTime:true - name:descriptiondescription:A description of the eventtype:string - name:orgNamedescription:The name of the organizationtype:string - name:clientIpdescription:The IP address of the clienttype:stringindicators: - ip - name:requestUrldescription:The URL of the requesttype:stringindicators: - hostname - name:loginNamedescription:The name of the user who logged intype:stringindicators: - username - name:flaggeddescription:Whether the event is flagged or nottype:boolean
schema:CarbonBlack.AlertV2description:Alert logs generated by the Carbon Black CloudreferenceURL:https://developer.carbonblack.com/reference/carbon-black-cloud/data-forwarder/schema/latest/alert-2.0.0/fields: - name:additional_events_present description: Indicator to let API and forwarder users know that they should look up other associated events related to this alert
type:boolean - name:alert_notes_presentdescription:True if notes are present on the alert ID. False if notes are not present.type:boolean - name:alert_urldescription:Link to the alerts page for this alert. Does not vary by alert typetype:stringrequired:trueindicators: - url - name:backend_timestamp description: Timestamp when the Carbon Black Cloud processed and enabled the alert for searching. Corresponds to the Created column on the Alerts page.
type:timestamptimeFormat:rfc3339 - name:backend_update_timestamp description: Timestamp when the Carbon Black Cloud initiated and processed an update to an alert. Corresponds to the Updated column on the Alerts page.
type:timestamptimeFormat:rfc3339 - name:blocked_effective_reputation description: Effective reputation of the blocked file or process; applied by the sensor at the time the block occurred
type:string - name:blocked_md5description:MD5 hash of the child process binary; for any process terminated by the sensortype:stringindicators: - md5 - name:blocked_namedescription:Tokenized file path of the files blocked by sensor actiontype:string - name:blocked_sha256description:SHA-256 hash of the child process binary; for any process terminated by the sensortype:stringindicators: - sha256 - name:childproc_cmdlinedescription:Command line for the child processtype:string - name:childproc_effective_reputationdescription:Effective reputation of the child process; applied by the sensor at the time the event occurredtype:string - name:childproc_guiddescription:Unique process identifier assigned to the child processtype:string - name:childproc_md5description:Hash of the child process' binary (Enterprise EDR)type:stringindicators: - md5 - name:childproc_namedescription:Filesystem path of the child process' binarytype:string - name:childproc_sha256description:Hash of the child process' binary (Endpoint Standard)type:stringindicators: - sha256 - name:childproc_usernamedescription:User context in which the child process was executedtype:stringindicators: - username - name:detection_timestamp description: Timestamp when the alert was first detected. For sensor-sent alerts, this is the time of the event on the sensor. For alerts generated on the backend, this is the time the backend system triggered the alert.
type:timestamptimeFormat:rfc3339required:trueisEventTime:true - name:determinationdescription:User-updatable determination of the alerttype:objectfields: - name:change_timestampdescription:Timestamp when the determination was updatedtype:timestamptimeFormat:rfc3339 - name:changed_bydescription:User the determination was changed bytype:stringindicators: - username - name:changed_by_typedescription:Type of user who changed the determinationtype:string - name:valuedescription:Determination value of the alert set by a usertype:string - name:device_external_ip description: IP address of the endpoint according to the Carbon Black Cloud; can differ from device_internal_ip due to network proxy or NAT; either IPv4 (dotted decimal notation) or IPv6 (proprietary format)
type:stringindicators: - ip - name:device_iddescription:ID of devicestype:string - name:device_internal_ip description: IP address of the endpoint reported by the sensor; either IPv4 (dotted decimal notation) or IPv6 (proprietary format)
type:stringindicators: - ip - name:device_location description: Whether the device was on or off premises when the alert started, based on the current IP address and the device’s registered DNS domain suffix
type:string - name:device_namedescription:Device nametype:string - name:device_osdescription:Device Operating Systemstype:string - name:device_os_versiondescription:The operating system and version of the endpoint. Requires Windows CBC sensor version 3.5 or later.type:string - name:device_policydescription:Device policytype:string - name:device_policy_iddescription:Device policy idtype:string - name:device_target_valuedescription:Target value assigned to the device, set from the policytype:string - name:device_uem_iddescription:Device correlation with WS1/EUC, required for our Workspace ONE Intelligence integration to functiontype:string - name:device_usernamedescription:Users or device owners of alertstype:stringindicators: - username - name:first_event_timestampdescription:Timestamp when the first event in the alert occurredtype:timestamptimeFormat:rfc3339 - name:iddescription:Unique ID of alerttype:stringrequired:true - name:is_updated description: Set to true if this is an updated copy of the alert initiated by the Carbon Black Cloud backend. User workflow updates, such as adding a note, will generate a new copy of the alert, but is_updated will be set to false.
type:boolean - name:last_event_timestampdescription:Timestamp when the last event in the alert occurredtype:timestamptimeFormat:rfc3339 - name:netconn_local_ipdescription:IP address of the remote side of the network connection; stored as dotted decimaltype:stringindicators: - ip - name:netconn_local_ipv4 description: IPv4 address of the local side of the network connection; stored as a dotted decimal. Only one of ipv4 and ipv6 fields will be populated.
type:stringindicators: - ip - name:netconn_local_ipv6 description: IPv6 address of the local side of the network connection; stored as a string without octet-separating colon characters. Only one of ipv4 and ipv6 fields will be populated.
type:stringindicators: - ip - name:netconn_local_portdescription:TCP or UDP port used by the local side of the network connectiontype:int - name:netconn_protocoldescription:Network protocol of the network connectiontype:string - name:netconn_remote_domaindescription:Domain name (FQDN) associated with the remote end of the network connection, if availabletype:stringindicators: - domain - name:netconn_remote_ipdescription:IP address of the local side of the network connection; stored as dotted decimaltype:stringindicators: - ip - name:netconn_remote_ipv4 description: IPv4 address of the remote side of the network connection; stored as dotted decimal. Only one of ipv4 and ipv6 fields will be populated.
type:stringindicators: - ip - name:netconn_remote_ipv6 description: IPv6 address of the remote side of the network connection; stored as a string without octet-separating colon characters. Only one of ipv4 and ipv6 fields will be populated.
type:stringindicators: - ip - name:netconn_remote_port description: TCP or UDP port used by the remote side of the network connection; same as netconn_port and event_network_remote_port
type:int - name:org_keydescription:Unique alphanumeric string that identifies your organization in the Carbon Black Cloudtype:string - name:parent_cmdlinedescription:Command line of the parent processtype:string - name:parent_effective_reputationdescription:Effective reputation of the parent process; applied by the sensor when the event occurredtype:string - name:parent_guiddescription:Unique process identifier assigned to the parent processtype:string - name:parent_md5description:MD5 hash of the parent process binarytype:stringindicators: - md5 - name:parent_namedescription:Filesystem path of the parent process binarytype:string - name:parent_piddescription:Identifier assigned by the operating system to the parent processtype:string - name:parent_reputation description: Reputation of the parent process; applied by the Carbon Black Cloud when the event is initially processed
type:string - name:parent_sha256description:SHA-256 hash of the parent process binarytype:stringindicators: - sha256 - name:parent_usernamedescription:User context in which the parent process was executedtype:stringindicators: - username - name:policy_applieddescription:Indicates whether or not a policy has been applied to any event associated with this alerttype:string - name:primary_event_iddescription:ID of the primary event in the alerttype:string - name:process_cmdlinedescription:Command line executed by the actor processtype:string - name:process_effective_reputationdescription:Effective reputation of the actor hashtype:string - name:process_guiddescription:Guid of the process that has fired the alert (optional)type:string - name:process_issuerdescription:The certificate authority associated with the process’s certificatetype:arrayelement:type:string - name:process_md5description:MD5 hash of the actor process binarytype:stringindicators: - md5 - name:process_namedescription:Process names of an alerttype:string - name:process_piddescription:PID of the process that has fired the alert (optional)type:string - name:process_publisherdescription:Publisher name on the certificate used to sign the Windows or macOS process binarytype:arrayelement:type:string - name:process_reputationdescription:Reputation of the actor process; applied when event is processed by the Carbon Black Cloudtype:string - name:process_sha256description:SHA-256 hash of the actor process binarytype:stringindicators: - sha256 - name:process_username description: User context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid()
type:stringindicators: - username - name:reason description: A spoken language written explanation of the what and why the alert occurred and any action taken, usually consisting of 1 to 3 sentences.
type:string - name:reason_codedescription:A unique short-hand code or GUID identifying the particular alert reasontype:string - name:run_statedescription:Whether the threat in the alert actually rantype:string - name:sensor_actiondescription:Actions taken by the sensor, according to the rules of a policytype:string - name:severitydescription:Integer representation of the impact of alert if true positivetype:int - name:threat_iddescription:ID assigned to a group of alerts with common criteria, based on alert typetype:string - name:typedescription:Type of alert generatedtype:stringrequired:true - name:user_update_timestamp description: Timestamp of the last property of an alert changed by a user, such as the alert workflow or determination
type:timestamptimeFormat:rfc3339 - name:versiondescription:The version of the schema being emitted. e.g. 2.0.0type:string - name:workflow description: Current workflow state of an alert. The workflow represents the flow from OPEN to IN_PROGRESS to CLOSED and captures who moved the alert into the current state. The history of these state transitions is available via the alert history route.
type:objectfields: - name:change_timestampdescription:When the last status change occurredtype:timestamptimeFormat:rfc3339 - name:changed_bydescription:Who (or what) made the last status changetype:string - name:changed_by_typedescription:Type of user or system that made the last status changetype:string - name:changed_by_autoclose_rule_iddescription:The ID of the autoclose rule that closed the alerttype:string - name:closure_reasondescription:A more detailed description of why the alert was resolvedtype:string - name:statustype:string - name:attack_tactic description: A tactic from the MITRE ATT&CK framework; defines a reason for an adversary’s action, such as achieving credential access
type:string - name:attack_technique description: A technique from the MITRE ATT&CK framework; defines an action an adversary takes to accomplish a goal, such as dumping credentials to achieve credential access
type:string - name:rule_category_iddescription:ID representing the category of the rule_id for certain alert typestype:string - name:rule_id description: ID of the rule that triggered an alert; applies to Intrusion Detection System, Host-Based Firewall, TAU Intelligence, and USB Device Control alerts
type:string - name:threat_categorydescription:Categories of threats which we were able to take action ontype:string - name:ttpsdescription:Other potential malicious activities involved in a threattype:arrayelement:type:string - name:connection_typedescription:Connection Typetype:string - name:egress_group_iddescription:Unique identifier for the egress grouptype:string - name:egress_group_namedescription:Name of the egress grouptype:string - name:ip_reputationdescription:Range of reputations to accept for the remote IPtype:int - name:k8s_clusterdescription:K8s Cluster nametype:string - name:k8s_kinddescription:K8s Workload kindtype:string - name:k8s_namespacedescription:K8s namespacetype:string - name:k8s_pod_namedescription:Name of the pod within a workloadtype:string - name:k8s_policydescription:Name of the K8s policytype:string - name:k8s_policy_iddescription:Unique identifier for the K8s policytype:string - name:k8s_ruledescription:Name of the K8s policy ruletype:string - name:k8s_rule_iddescription:Unique identifier for the K8s policy ruletype:string - name:k8s_workload_namedescription:K8s Workload Nametype:string - name:remote_is_privatedescription:Is the remote information private true or falsetype:boolean - name:remote_k8s_kinddescription:Kind of remote workload; set if the remote side is another workload in the same clustertype:string - name:remote_k8s_namespace description: Namespace within the remote workload’s cluster; set if the remote side is another workload in the same cluster
type:string - name:remote_k8s_pod_namedescription:Remote workload pod name; set if the remote side is another workload in the same clustertype:string - name:remote_k8s_workload_namedescription:Name of the remote workload; set if the remote side is another workload in the same clustertype:string - name:external_device_friendly_namedescription:Human-readable external device namestype:string - name:product_iddescription:IDs of the product that identifies USB devicestype:string - name:product_namedescription:Names of the product that identifies USB devicestype:string - name:serial_numberdescription:Serial numbers of USB devicestype:string - name:vendor_iddescription:IDs of the vendor that identifies USB devicestype:string - name:vendor_namedescription:Names of the vendors who produced the devicestype:string - name:threat_namedescription:Name of the threattype:string - name:tms_rule_iddescription:Detection idtype:string - name:ioc_fielddescription:The field the indicator of comprise (IOC) hit containstype:string - name:ioc_hitdescription:IOC field value or IOC query that matchestype:string - name:ioc_iddescription:Unique identifier of the IOC that generated the watchlist hittype:string - name:ml_classification_final_verdictdescription:Final verdict of the alert, based on the ML models that were used to make the prediction.type:string - name:ml_classification_global_prevalence description: Categories (low/medium/high) used to describe the prevalence of alerts across all regional organizations.
type:string - name:ml_classification_org_prevalencedescription:Categories (low/medium/high) used to describe the prevalence of alerts within an organization.type:string - name:report_descriptiondescription:Description of the reporttype:string - name:report_iddescription:Report IDs that contained the IOC that caused a hittype:string - name:report_linkdescription:Link of reports that contained the IOC that caused a hittype:stringindicators: - url - name:report_namedescription:Name of the watchlist reporttype:string - name:report_tagsdescription:Tags associated with the watchlist reporttype:arrayelement:type:string - name:watchlistsdescription:List of watchlists associated with an alert. Alerts are batched hourlytype:arrayelement:type:objectfields: - name:iddescription:Unique identifier of the watchlisttype:string - name:namedescription:Name of the watchlisttype:string - name:mdr_alertdescription:Is the alert eligible for review by Carbon Black MDR Analysts?type:boolean - name:mdr_alert_notes_presentdescription:Customer visible notes at the alert level that were added by an MDR analysttype:boolean - name:mdr_determinationdescription:MDR updatable classification of the alerttype:objectfields: - name:change_timestampdescription:When the MDR determination was last changedtype:timestamptimeFormat:rfc3339 - name:value description: A record that identifies the whether the alert was determined to represent a likely or unlikely threat.
type:string - name:mdr_workflowdescription:MDR-updatable workflow of the alerttype:objectfields: - name:change_timestampdescription:When the MDR workflow was last changedtype:timestamptimeFormat:rfc3339 - name:statustype:stringdescription:Primary value used to capture status change during MD Analyst’s alert triage - name:is_assignedtype:booleandescription:Indicates whether the alert is assigned or not
CarbonBlack.EndpointEvent
schema:CarbonBlack.EndpointEventdescription:Endpoint events from CarbonBlackreferenceURL: https://developer.carbonblack.com/reference/carbon-black-cloud/data-forwarder/schema/latest/endpoint.event-1.0.0/
fields: - name:actiondescription:Specific endpoint action observed by sensor during this event.type:stringrequired:true - name:backend_timestamp description: Time when the backend received the batch of events, based on Carbon Black Cloud backend’s clock as an RFC 3339 formatted time string based on UTC to the seconds; may differ from device_timestamp by a few minutes due to asynchronous processing
type:timestamptimeFormats: - '%Y-%m-%d %H:%M:%S %z %Z' - name:device_groupdescription:Sensor group to which the endpoint was assigned when the sensor recorded the event datatype:string - name:device_iddescription:ID of the device that created this eventtype:string - name:device_namedescription:Hostname of the device that created this eventtype:string - name:device_osdescription:OS Type of device (Windows/OSX/Linux)type:string - name:device_timestampdescription:Time seen on sensor, based on sensor’s clock in RFC 3339 UTC format to secondstype:timestamptimeFormats: - '%Y-%m-%d %H:%M:%S.%N %z %Z' - '%Y-%m-%d %H:%M:%S %z %Z'required:trueisEventTime:true - name:event_origindescription:Indicates which product the event came from.type:string - name:org_key description: The organization key associated with the console instance. Can be used to disambiguate events from different Carbon Black Cloud tenant organizations.
type:string - name:parent_guiddescription:Unique ID of parent process.type:string - name:parent_hash description: Cryptographic hashes of the executable file backing the parent process, represented as an array of two elements - MD5 and SHA-256 hash
type:arrayelement:type:stringindicators: - md5 - sha256 - name:parent_pathdescription:Full path to the executable file backing the parent process on the device’s file systemtype:string - name:parent_piddescription:OS-reported Process ID of the parent processtype:string - name:parent_reputation description: Reputation of the parent process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud
type:string - name:process_cmdlinedescription:Command line executed by the actor processtype:string - name:process_fork_pid description: The PID of a process forked from the actor on *nix systems. If process_pid != process_fork_pid, the current process was forked from original process_pid.
type:string - name:process_guiddescription:Unique ID of process.type:string - name:process_hash description: Cryptographic hashes of the executable file backing this process, represented as an array of two elements - MD5 and SHA-256 hash
type:arrayelement:type:stringindicators: - md5 - sha256 - name:process_pathdescription:Full path to the executable file backing this process on the device’s file systemtype:string - name:process_piddescription:OS-reported Process ID of the current processtype:string - name:process_reputation description: Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud
type:string - name:process_usernamedescription:
