EDR: How to monitor Event Forwarder service status via API

[#1]

Environment

• EDR Server: 7.1 and Higher (formerly CB Response)
• EDR Event Forwarder: 3.7.0 and Higher

Objective

Set up monitoring for the service status of Event Forwarder and start services if stopped

Resolution

1. Determine how often to check the running state of the service
2. Decide which scripting language / services to use to query the API
3. Add a GET request for the status of the service

   • https://<SERVER>/api/v1/event_forwarder/control

4. Use the "state" field returned to determine if the service is running. Different states are Running,Stopped, and Unknown
5. If stopped, send a POST request to the same control to start services with the following body

   • {"action":"START"}

Related Content

Event Forwarder Configuration API - Carbon Black Developer Network
EDR REST API Quick Start - Carbon Black Developer Network