EDR: How to Enable CB Threat Intel

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to enable Threat Intel

Environment

• EDR Server: 6.x (formerly CB Response)

Resolution

To enable 'Threat Intel':

1. Navigate to Profile
2. Click on Sharing Settings
3. Check the box for 'Enable Alliance Communication'
4. Navigate to Server Dashboard to confirm the Threat Intel box is green

Additional Information

These messages will appear in /var/log/cb/job_runner/job_runner.log if Alliance Communcation is not enabled:

2019-11-13 00:14:15 [19453] <info> [alliance_community_participation] starting alliance_community_participation /etc/cb/cb.conf --on-demand-diag-check
2019-11-13 00:14:15 [19453] <warning> [alliance_community_participation] Alliance comms are disabled
2019-11-13 00:14:15 [19453] <warning> [alliance_community_participation] Alliance Comms Disabled!
2019-11-13 00:14:15 [19453] <info> [alliance_community_participation] finished alliance_community_participation -- duration: 0:00:11.763179