How to Set Up Carbon Black Endpoint Standard in Rapid7 InsightIDR

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to set up Carbon Black Endpoint Standard in Rapid7 InsightIDR

Environment

• Carbon Black Cloud Console: Current Version
• Endpoint Standard: Current Version
• Rapid7 InsightIDR

Resolution

1. Login to InsightIDR console
2. From the left menu, go to Data Collection.
3. When the “Data Collection” page appears, click the Setup Event Source drop down and choose Add Event Source.
4. From the “Virus Scan” section, click the Carbon Black Defense icon. The “Add Event Source” panel appears. 
5. Choose the collector and event source. Name the event source if desired.
6. If sending additional events beyond alerts, select the unfiltered logs checkbox Carbon Black Endpoint Standard events. Carbon Black recommends use of TCP as the protocol.
7. Enter the API URL for Carbon Black Cloud: URLs are used to access the APIs 
8. In the SIEM API Key field, enter the secret key.
9. Enter the SIEM Connector ID. For more information about the SIEM Connector ID, see Carbon Black Cloud API Access.
10. Click Save.

Additional Information

• Must have a CUSTOM access level API key to use when accessing the CBC Alerts V7 API, which is now required. Follow the instructions outlined here to add the necessary permissions to access the Alerts V7 API: https://developer.carbonblack.com/reference/carbon-black-cloud/platform/latest/alerts-api/ 
  • Same CUSTOM Access Level profile will need to have the Observations API permissions as well if collecting that data: https://developer.carbonblack.com/reference/carbon-black-cloud/platform/latest/observations-api/ 
• Must obtain a Carbon Black Defense API URL, SIEM API key, and SIEM Connector ID. This information is important to set up a CB Endpoint Standard event source in InsightIDR. For instructions, see https://developer.carbonblack.com/reference/carbon-black-cloud/authentication/.

Verify the Configuration

• To verify that the configuration is correct, From the left menu, click Log Search to view the raw logs to ensure events are making it to the Collector. Carbon Black Cloud logs flow into Virus Scan log sets.