Carbon Black Cloud Audit log API: Can the legacy SIEM API key be replaced with custom level Audit log (read) permission level?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

v3/auditlogs errors when using Custom APL access level permission ->  Audit log = Read
curl -H ‘X-Auth-Token:AAAAAAAAAAAAAAAAAAAAAAAA/ZZZZZZZZZZ' https://defense-prod05.conferdeploy.net/integrationServices/v3/auditlogs
{"message":"Forbidden","success":false}

 

Environment

• Integration services/v3/auditlogs API: v3
• Carbon Black Cloud Server: All versions
• Carbon Black Cloud Sensor: All versins

Cause

This is limitation CBC-26867.

Resolution

CBC-26867 feature (currently on the road map May, 2023)  will allow v3/auditlogs API calls with the custom access level permission Audit log = Read.
Until then the legacy SIEM key is required.