EDR: How to enable audit logging for the cb-event-forwarder
book
Article ID: 290189
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Setup audit logging on the EDR server to send to the cb-event-forwarder and forward to a SIEM.
Environment
- EDR (formerly CB Response) Server: 6.2 and later
- CB Event Forwarder: 3.4.2 and later
Resolution
- Edit the /etc/cb/cb.conf file
- Set EnableAuditLogsToEvents=True
- Set EnableExtendedApiAuditLogging=True
- Edit the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf file
- Restart the cb-enterprise services per Cb Response: How to restart services
- Restart the cb-event-forwarder
- initctl stop cb-event-forwarder
- initctl start cb-event-forwarder
Feedback
thumb_up
Yes
thumb_down
No