CB Response: How to Place Links in cb-event-forwarder Output

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to enable the cb-event-forwarder to place deep links into the JSON or LEEF output so users can have one-click access to process, binary, or sensor context

Environment

• CB Response: 6.2.x and Higher

Resolution

1. Login as root to the CB Response OS
2. Edit the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf file 
3. Uncomment and place the base URL of your Cb Response server into the cb_server_url variable:
4. cb_server_url=base URL