EDR: How To Create A Custom Feed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to create a custom Threat Intelligence Feed in CB Response.

Environment

• EDR Server: All Versions

Resolution

Instructions on creating custom feeds can be found in the cbfeeds github repository https://github.com/carbonblack/cbfeeds/tree/master

Additional Information

• In the Feed_URL section, specify the .json file extension for the file type, or the add feed API will fail with a 500 Internal Server Error
• Depending on the format of the Feed JSON it may be necessary to add the feed manually providing both the Feed URL and the Provider URL