Hosted EDR: How to Configure Event Forwarder from Console

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Configure the CB Event Forwarder to connect with a SIEM

Environment

• Hosted EDR: All Versions 
• CB Event Forwarder: All Supported Versions

Resolution

As of version 7.1.0 the customer can configure the Event Forwarder from the console no Cloud Ops request is required see chapter 16 page 260 of the Users Guide

Additional Information

• CB Response Cloud does not support multiple event-forwarders
• If the IP of the cloud server is needed perform an nslookup on sensors.fqdn
• The CEF output format is no longer supported at this time until cb-event-forwarder version 4 is released
• SIEM traffic will need to be encrypted as non-encrypted traffic is not supported