Environment
- Carbon Black Console: All Supported Versions
- Carbon Black Cloud Syslog Connector: 1.x
Objective
How to troubleshoot Syslog Connector 1.x
Resolution
1. From within the Console, verify that a SIEM type connector has been created and is being used
2. From with the cb-defense-syslog.conf file found here: /etc/cb/integrations/cb-defense-syslog/cb-defense-syslog.conf verify the following:
- CBC Connector ID
- CBC API Key (from your SIEM connector)
- The correct API URL is being used, for a full list of URLs check here
The critical configs within the cb-defense-syslog.conf should look like this:
[cbdefense1]
# Cb Defense Connector ID
connector_id = TSDTG351A1
# Cb Defense API Key
api_key = NASD4342562IZ39EMMSDA2
# Cb Defense Server URL
server_url = Carbon Black Cloud # Prod02 URL
3. Check the cb-defense-syslog.log file for HTTP or Authentication errors found here /var/log/cb/integrations/cb-defense-syslog/cb-defense-syslog.log
4. Test connectivity through on-prem firewalls to your backend API URL
- Create a new API connector type from within the console
- Run this command: curl -H X-Auth-Token:API_KEY/CONNECTOR_ID https://api5.conferdeploy.net/integrationServices/v3/device
- If this command worked then connectivity has been verified, try re-creating your SIEM connector and update your keys within the .conf file
- If this fails, check firewall rules (local and site) to ensure proper exclusions are in place per these documents:
- If connectivity is still failing after the firewall rules have been checked, collect a network packet capture, the cb-defense-syslog.log and cb-defense-syslog.conf and create a ticket with support
5. If events are not being received verify:
- The connectivity checks listed above are passed and no errors are found in the cb-defense-syslog.log file
- Ensure a Notification has been created and tied to the Connector from the console
- From the Connectors page select the Notifications Icon and verify alerts are being "Sent". If "NOT_TRIGGERED" is listed, adjust your Notification rules accordingly
Related Content
