EDR: How to enable audit logging for the cb-event-forwarder

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Setup audit logging on the EDR server to send to the cb-event-forwarder and forward to a SIEM.

Environment

• EDR (formerly CB Response) Server: 6.2 and later
• CB Event Forwarder: 3.4.2 and later

Resolution

1. Edit the /etc/cb/cb.conf file
   • Set EnableAuditLogsToEvents=True
   • Set EnableExtendedApiAuditLogging=True
2. Edit the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf file
   • Set audit_log=true
3. Restart the cb-enterprise services per Cb Response: How to restart services
4. Restart the cb-event-forwarder
   • initctl stop cb-event-forwarder
   • initctl start cb-event-forwarder