Cb Defense: What is the IP Address used by Cb Defense for inbound SIEM Connector connections?

[#1]

Environment

• Cb Defense SIEM Connector: All Versions

Question

What IP Addresses need to be whitelisted for the inbound connections to the Cb Defense SIEM Connector?

Answer

• The URL that needs to be whitelisted is the same API URL that is configured in the cb-defense-syslog.conf file, under the server_url line.

Additional Notes

• The API URL's can be found here: Re: Anyone confirgured rules for SCOM health monitoring scripts?
• If you must whitelist on an IP address and cannot use a URL instead, you can run as nslookup on the URL for your backend. Please note, the IP addresses are subject to change without any notice.

Related Content

Cb Defense: How to configure cb-defense-syslog.conf for SIEM Connectors
Cb Defense: What firewall ports need to be open for the SIEM Connector?