EDR: What Data is Sent Over CB Event Forwarder?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What data is sent over CB Event Forwarder to the SIEM?

Environment

• EDR: All Versions
• CB Event Forwarder: All Supported Versions

Resolution

Setting	Default Value	Optional Values	Description	Associated CB.Conf Setting
audit_log	False	True	audit.log.useractivity audit.log.liveresponse audit.log.isolation audit.log.banning	EnableExtendedApiAuditLogging=true EnableAuditLogsToEvents=true
api_token	None	None	Additional info from the REST API	None
remove_from_output	highlights_by_doc	None	Prevents this field from causing issues with QRadar and Splunk	None
events_watchlist	All	watchlist.hit.process watchlist.hit.binary watchlist.storage.hit.process watchlist.storage.hit.binary	Watchlist Hits	None
events_feed	All	feed.ingress.hit.process feed.ingress.hit.binary feed.ingress.hit.host feed.storage.hit.process feed.storage.hit.binary feed.query.hit.process feed.query.hit.binary	Feed Hits	None
events_alert	All	alert.watchlist.hit.ingress.process alert.wtachlist.hit.ingress.binary alert.watchlist.hit.ingress.host alert.watchlist.hit.query.process alert.watchlist.hit.query.binary	Alert Events	None
events_binary_observed	All	binaryinfo.observed binaryinfo.host.observed binaryinfo.group.observed	Binary Observed Events	None
events_binary_upload	All	binarystore.file.added	Binary Upload Events	None
use_raw_sensor_exchange events_raw_sensor	False 0 (Disabled)	ingress.event.process ingress.event.procstart ingress.event.netconn ingress.event.procend ingress.event.childproc ingress.event.moduleload ingress.event.module ingress.event.filemod ingress.event.regmod ingress.event.tamper ingress.event.crossprocopen ingress.event.remotethread ingress.event.processblock ingress.event.emetmitigation	Raw Sensor (endpoint) Events	EnableRawSensorDataBroadcast=true

Additional Information

• Enabling the "events_raw_sensor" setting can create a very high load and consume a Splunk license.
• If the "events_raw_sensor" feature causes performance issues on a Cloud instance it will be disabled and the contact on record will be notified.
• For a description of the events being sent look here