Carbon Black Cloud: Can you filter events from being forwarded to S3 bucket?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Is it possible to filter events from being forwarded to S3 bucket for Carbon Black Cloud?

Environment

• Carbon Black Cloud Console

Resolution

Yes! Event filtering for CBC eventforwarder ia available now as of 09/14/2020

Additional Information

• Data Filtering is available for forwarders of type “endpoint.event”
• If you want to remove or modify an existing filter then edit the configuration with the desired filter change.
• To remove all filters for a configuration set the filter property to an empty array.