EDR: Is it possible to limit the data sent to the Lastline integration connector?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is it possible to limit the data sent to the Lastline integration connector?

Environment

• EDR Server: All Supported Versions
• Lastline Connector: Supported Versions

Resolution

Yes. According to the Carbon Black developer GitHub site for this Lastline connector there is a section in the configuration file that describes some of the filtering options built into the connector.

Additional Information

• Here is an example section from the Lastline configuration file:

; binary_filter_query
; Additional query options to filter only binaries of interest to the Lastline connector
;
binary_filter_query=is_executable_image:true -(digsig_publisher:"Microsoft Corporation" and digsig_result:"Signed")

• Users can create a binary filter to choose what specific data is sent up to the Lastline cloud for analysis.