Carbon Black Cloud: SIEM/API Notifications Do Not Include EEDR Alert/Investigate URL

[#1]

Environment

• Carbon Black Cloud Console: All Supported Versions
• VMware Carbon Black Cloud App for Splunk: 1.x
• Splunk: 8.x

Symptoms

Alert URL is not included in the data sent to SIEM/API

Cause

The Data forwarder which is required to populate the Alert URL was not configured

Resolution

The below workaround can be followed:

1. Copy the DEVICE_ID and ALERT_ID from the notification
2. Navigate to the Investigate page
3. Format a search query including the following search fields

• device_id:{DEVICE_ID} AND alert_id:{ALERT_ID}

Related Content

Carbon Black Cloud: What Splunk Apps/Add-Ons are needed?
CB Defense: How to Setup and Configure Splunk Enterprise to Receive Data
CB ThreatHunter: What Is Needed To Integrate With Splunk?
CB ThreatHunter: How to Setup and Configure Splunk Enterprise to Receive Data
Carbon Black Cloud: How to Enable Data Forwarders