Carbon Black Cloud: Date Format Is Not Padded on Files Sent to S3 (Data Forwarders)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Date format of files sent to S3 bucket via Data Forwarder do not pad single-digit date-parts with zeroes (0)

  .../year=2022/month=7/day=3/hour=9/minute=9/second=16/....jsonl.gz

• Files do not sort naturally in S3
• Unable to use ListObjectsV2 API in AWS to sort

Environment

• Carbon Black Cloud Console: 26-Apr-2021 (0.65.5) and Higher
• Carbon Black Cloud Data Forwarder API: All Versions
• Amazon Simple Storage Service (AWS S3): All Supported Versions

Cause

Carbon Black Cloud Data Forwarder was not designed to pad dates with zeroes

Resolution

Working as currently designed

Additional Information

• Future versions of the Data Forwarder may provide this option, potential work to add zero-padding is tracked under CBDVF-171 
• Contact the VMware Carbon Black Sales, Account, Customer Success, or Professional Services team for your organization to submit a feature request referencing CBDVF-171 for increased visibility on customer desire for such a feature