Environment
- Carbon Black Cloud Console: All Versions
- Carbon Black Workload Appliance: All Versions
- Microsoft Windows: All Supported Versions
Question
When defining the configuration for QRadar in Carbon Black Cloud console is the Authorized IP Addresses field required to be filled?
Answer
- The Authorized IP Address field should only be defined for specific IP addresses accessing the API Key/Connector ID.
- If IP addresses are added to Authorized IP Addresses field, then logs will only be sent to the defined IP addresses.
- If the Authorized IP Addresses field is left blank, then any IP address will be able to connect using the API Key/Connector ID.
Additional Notes
- You can see what IP address is accessing the API key by searching the Audit log for those API keys.
- The Authorized IP Addresses field will require Public IP addresses opposed to Private IP addresses.
Related Content
