CB ThreatHunter: What Is Needed To Integrate With Splunk?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What needs to be done to send information from CB ThreatHunter to Splunk?

Environment

• CB ThreatHunter PSC Console: All Versions
• Splunk Enterprise: All Supported Versions
• Splunk Cloud: All Supported Versions
• Splunk Light: Not supported

Resolution

The most current information is available on https://splunkbase.splunk.com/app/4330/#/details

Additional Information

• Searching SplunkBase will return the latest apps and add-ons: https://splunkbase.splunk.com/apps/#/search/CB%20ThreatHunter/
• For either Splunk Cloud or Enterprise, only the App (https://splunkbase.splunk.com/app/4330/#/details) is required, the Add-Ons are optional
• The Carbon Black Developer Network will be updated to include additional information (https://developer.carbonblack.com/reference/cb-threathunter/)