Carbon Black Cloud: Where do I find information on Yara integration?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Carbon Black Cloud: Where do I find information on Yara integration?

Environment

• Carbon Black Cloud Console: All versions

Resolution

Our developers have a toolkit aimed to sysadmins build out their pipeline exactly as they desire:
https://github.com/carbonblack/cbc-binary-toolkit

 

Additional Information

The link below explains how to configure the toolkit:
https://github.com/carbonblack/cbc-binary-toolkit/wiki/Configuring-Yara-Rules

The following example can be used as a starting point:
https://github.com/carbonblack/cbc-binary-toolkit/tree/develop/src/cbc_binary_toolkit_examples/engine/yara_local