logo

Knowledge Base

Access official resources from Carbon Black experts

IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Hosted EDR: How to Configure Event Forwarder from Console

Hosted EDR: How to Configure Event Forwarder from Console

Environment

  • Hosted EDR: All Versions 
  • CB Event Forwarder: All Supported Versions

Objective

Configure the CB Event Forwarder to connect with a SIEM

Resolution

As of version 7.1.0 the customer can configure the Event Forwarder from the console no Cloud Ops request is required see chapter 16 page 260 of the Users Guide

Additional Notes

  • CB Response Cloud does not support multiple event-forwarders
  • If the IP of the cloud server is needed perform an nslookup on sensors.fqdn
  • The CEF output format is no longer supported at this time until cb-event-forwarder version 4 is released
  • SIEM traffic will need to be encrypted as non-encrypted traffic is not supported

Related Content


Labels (1)
Labels:
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
CB_Support
Creation Date:
‎09-09-2020
Views:
3219
Contributors
logo

Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.