EDR: Where can someone get support for the CB Splunk Application?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Where can someone get support for the CB Splunk Application?

Environment

• EDR Server: All versions
• EDR Sensor: All versions
• CB Splunk Application: All versions

Resolution

Getting Support

• View all API and integration offerings on the Developer Network along with reference documentation, video tutorials, and how-to guides.
• Use the Developer Community Forum to discuss issues and get answers from other API developers in the VMware Carbon Black Community.
• Report bugs and change requests to Carbon Black Support with the following logs from $SPLUNK_HOME/var/log/splunk
  • da-ess-cbresponse.log: main log file for common Carbon Black EDR helper functions, including the search Custom Commands
  • isolate_modalert.log: log file for the Isolate Endpoint Adaptive Response Action
  • banhash_modalert.log: log file for the Ban Hash Adaptive Response Action
  • killprocess_modalert.log: log file for the Kill Process Adaptive Response Action