EDR: How to configure proxy settings for Alliance Feeds

[#1]

Environment

• EDR (Formerly Carbon Black Response) Server: 6.x or Higher

Objective

Setup proxy server for EDR Server/Cluster to update Alliance Feeds

Resolution

1. Enter the required details and uncomment the required lines in /etc/cb/cb.conf:

   # Alliance Proxy Settings
   # Specifies the proxy to be used for internet access
   #AllianceClientProxyUrl=http://127.0.0.1:3128
   
   # Specify the type of authentication the proxy uses. Supported types are
   # either "basic" or "ntlm"
   #AllianceClientProxyAuth=basic
   
   # Specify the username and password if your proxy requires them.
   # Use the script at /usr/share/cb/cbpasswd with the --encryptpasswd
   # flag to generate an encrypted version of the proxy password for use
   # with the AllianceClientProxyEncryptedPassword field or else
   # use AllianceClientProxyPlaintextPassword for unencrypted passwords
   #AllianceClientProxyUsername=None
   #AllianceClientProxyPlaintextPassword=None
   #AllianceClientProxyEncryptedPassword=None
   

2. Restart the cb-enterprise service on a standalone server, or restart the cluster:

• For a standalone server:

  service cb-enterprise restart

• For a cluster:

  /usr/share/cb/cbcluster stop 
  /usr/share/cb/cbcluster start

Additional Notes

If the proxy is configured with a username and password, and the config doesn't take, use below format instead of the suggested one in the conf:

AllianceClientProxyUrl=http://proxy_user_name:password@proxy_server:port

Related Content

EDR: Cb Threat Intel Enabled But Not Connected
EDR: How To Create A Custom Feed
EDR: F5 Configuration for Carbon Black Response clusters