Share via

The Sentinel Connector for Carbon Black Cloud is very broken

David Broggy 6,376 Reputation points MVP Volunteer Moderator
2023-04-26T23:00:37.45+00:00

Hi there,

The Sentinel Connector for Carbon Black Cloud appears to be obsolete.

I pulled it from the content hub and installed it.

It uses an azure function.

The function is pointing to an obsolete api.

Has anyone made this work?

Microsoft Security | Microsoft Sentinel

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Blumhardt 10,051 Reputation points Microsoft Employee
    2023-04-27T10:53:09.91+00:00

    I can ask around internally. There is a stand alone S3 connector that might work for now. There is also a Ratings & Reviews tab that you might use to inform the author. There is also a general feedback form on the main solution page.

  2. Prateek Taneja 0 Reputation points Microsoft Employee
    2023-05-03T13:25:01.8366667+00:00

    @David Broggy

    An update to the Carbon Black connector (Azure Functions' App) was released when the older APIs were deprecated/deactivated.

    The current Azure Functions' App uses the APIs documented here:

    https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/

    Get Audit Log Events

    GET /integrationServices/v3/auditlogs

    Get Notifications

    GET /integrationServices/v3/notification

    In addition, it also ingests EDR Events published to an S3 bucket. Configuration of the bucket is documented here - https://developer.carbonblack.com/reference/enterprise-response/connectors/event-forwarder/event-forwarder-s3-bucket-configuration/

    Are you suggesting that these APIs are obsolete?

    0 comments
  3. David Broggy 6,376 Reputation points MVP Volunteer Moderator
    2023-05-03T15:45:48.46+00:00

    Apologies for not replying with an update on this.

    I figured it all out and posted a blog about how to make it work here:

    https://simple-security.ca/2023/05/02/cheat-sheet-for-configuring-carbon-black-cloud-edr-for-sentinel/

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.