--- title: VMware Carbon Black EDR Integration description: The VMware Carbon Black EDR integration collects EDR Server and raw Endpoint events exported by Carbon Black EDR Event Forwarder. The following output... url: https://www.elastic.co/docs/reference/integrations/carbonblack_edr products: - Elastic integrations applies_to: - Serverless Observability projects: Generally available - Serverless Security projects: Generally available - Elastic Stack: Generally available since 9.0 --- # VMware Carbon Black EDR Integration | | | |-------------------------------------------------------------------------------------------------|---------------------------------| | **Version** | 1.22.0 ([View all](#changelog)) | | **Subscription level**[What's this?](https://www.elastic.co/subscriptions) | Basic | | **Developed by**[What's this?](https://www.elastic.co/docs/reference/integrations/developed-by) | Elastic | | **Ingestion method(s)** | File, Network Protocol, Webhook | | **Minimum Kibana version(s)** | 9.0.08.13.0 | The VMware Carbon Black EDR integration collects EDR Server and raw Endpoint events exported by [Carbon Black EDR Event Forwarder.](https://github.com/carbonblack/cb-event-forwarder) The following output methods are supported: `http`, `tcp`, `udp` and `file`. ## Compatibility This integration has been tested with the 3.7.4 version of EDR Event Forwarder. ## Configuration The following configuration is necessary in `cb-event-forwarder.conf`: - `output_format=json` (default) For `http` output: - `output_type=http` - `http_post_template=[{{range .Events}}{{.EventText}}{{end}}]` - `content_type=application/json` (default) For `tcp` output: - `output_type=tcp` - `tcpout=
:` For `udp` output: - `output_type=tcp` - `tcpout=
:` For `file` output: - `output_type=file` - `outfile=` ```json { "@timestamp": "2014-04-11T19:21:33.682Z", "agent": { "ephemeral_id": "7bb86a18-d262-4348-b206-131e38d2d1c8", "id": "9cb9fa70-f3e9-45d8-b1cb-61425bd93e1a", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.0.0-beta1" }, "carbonblack": { "edr": { "event_timestamp": 1397244093.682, "feed_id": 7, "feed_name": "dxmtest1", "ioc_attr": {}, "md5": "506708142BC63DABA64F2D3AD1DCD5BF", "report_id": "dxmtest1_04", "sensor_id": 3321 } }, "data_stream": { "dataset": "carbonblack_edr.log", "namespace": "ep", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { "id": "9cb9fa70-f3e9-45d8-b1cb-61425bd93e1a", "snapshot": false, "version": "8.0.0-beta1" }, "event": { "action": "unknown", "agent_id_status": "verified", "dataset": "carbonblack_edr.log", "ingested": "2022-01-25T07:45:03Z", "kind": "event", "original": "{\"md5\":\"506708142BC63DABA64F2D3AD1DCD5BF\",\"report_id\":\"dxmtest1_04\",\"ioc_type\":\"md5\",\"ioc_value\":\"506708142bc63daba64f2d3ad1dcd5bf\",\"ioc_attr\":{},\"feed_id\":7,\"hostname\":\"FS-SEA-529\",\"sensor_id\":3321,\"cb_version\":\"4.2.1.140808.1059\",\"server_name\":\"localhost.localdomain\",\"feed_name\":\"dxmtest1\",\"event_timestamp\":1397244093.682}\n" }, "host": { "name": "FS-SEA-529" }, "input": { "type": "udp" }, "log": { "source": { "address": "172.19.0.4:46263" } }, "observer": { "name": "localhost.localdomain", "product": "Carbon Black EDR", "type": "edr", "vendor": "VMWare", "version": "4.2.1.140808.1059" }, "tags": [ "carbonblack_edr-log", "forwarded", "preserve_original_event" ], "threat": { "indicator": { "file": { "hash": { "md5": "506708142bc63daba64f2d3ad1dcd5bf" } }, "type": "file" } } } ``` | Field | Description | Type | |--------------------------------------------------|---------------------------------------------------------------|------------------| | @timestamp | Event timestamp. | date | | carbonblack.edr.action | | keyword | | carbonblack.edr.actiontype | | keyword | | carbonblack.edr.alert_severity | | double | | carbonblack.edr.alert_type | | keyword | | carbonblack.edr.blocked | | boolean | | carbonblack.edr.blocked_event | | keyword | | carbonblack.edr.blocked_reason | | keyword | | carbonblack.edr.blocked_result | | keyword | | carbonblack.edr.cb_server | | keyword | | carbonblack.edr.cb_version | | keyword | | carbonblack.edr.child_command_line | | keyword | | carbonblack.edr.child_pid | | long | | carbonblack.edr.child_process_guid | | keyword | | carbonblack.edr.child_suppressed | | boolean | | carbonblack.edr.child_username | | keyword | | carbonblack.edr.childproc_count | | long | | carbonblack.edr.childproc_type | | keyword | | carbonblack.edr.command_line | | keyword | | carbonblack.edr.comms_ip | | keyword | | carbonblack.edr.compressed_size | | long | | carbonblack.edr.computer_name | | keyword | | carbonblack.edr.created | | boolean | | carbonblack.edr.created_time | | keyword | | carbonblack.edr.cross_process_type | | keyword | | carbonblack.edr.crossproc_count | | long | | carbonblack.edr.digsig.issuer_name | | keyword | | carbonblack.edr.digsig.program_name | | keyword | | carbonblack.edr.digsig.publisher | | keyword | | carbonblack.edr.digsig.result | | keyword | | carbonblack.edr.digsig.result_code | | keyword | | carbonblack.edr.digsig.sign_time | | keyword | | carbonblack.edr.digsig.subject_name | | keyword | | carbonblack.edr.direction | | keyword | | carbonblack.edr.doc | | flattened | | carbonblack.edr.domain | | keyword | | carbonblack.edr.emet_timestamp | | long | | carbonblack.edr.event_timestamp | | double | | carbonblack.edr.event_type | | keyword | | carbonblack.edr.expect_followon_w_md5 | | boolean | | carbonblack.edr.feed_id | | keyword | | carbonblack.edr.feed_name | | keyword | | carbonblack.edr.feed_rating | | double | | carbonblack.edr.file_md5 | | keyword | | carbonblack.edr.file_path | | keyword | | carbonblack.edr.file_sha256 | | keyword | | carbonblack.edr.filemod_count | | long | | carbonblack.edr.filetype | | keyword | | carbonblack.edr.filetype_name | | keyword | | carbonblack.edr.filtering_known_dlls | | boolean | | carbonblack.edr.group | | keyword | | carbonblack.edr.host | | keyword | | carbonblack.edr.hostname | | keyword | | carbonblack.edr.icon | | keyword | | carbonblack.edr.image_file_header | | keyword | | carbonblack.edr.interface_ip | | keyword | | carbonblack.edr.ioc_attr | | flattened | | carbonblack.edr.ioc_confidence | | double | | carbonblack.edr.ioc_type | | keyword | | carbonblack.edr.ioc_value | | keyword | | carbonblack.edr.ipv4 | | keyword | | carbonblack.edr.is_target | | boolean | | carbonblack.edr.ja3 | | keyword | | carbonblack.edr.ja3s | | keyword | | carbonblack.edr.link_child | | keyword | | carbonblack.edr.link_md5 | | keyword | | carbonblack.edr.link_parent | | keyword | | carbonblack.edr.link_process | | keyword | | carbonblack.edr.link_sensor | | keyword | | carbonblack.edr.link_target | | keyword | | carbonblack.edr.local_ip | | keyword | | carbonblack.edr.local_port | | long | | carbonblack.edr.log_id | | keyword | | carbonblack.edr.log_message | | keyword | | carbonblack.edr.md5 | | keyword | | carbonblack.edr.mitigation | | keyword | | carbonblack.edr.modload_count | | long | | carbonblack.edr.netconn_count | | long | | carbonblack.edr.os_type | | keyword | | carbonblack.edr.parent_create_time | | long | | carbonblack.edr.parent_guid | | keyword | | carbonblack.edr.parent_md5 | | keyword | | carbonblack.edr.parent_path | | keyword | | carbonblack.edr.parent_pid | | long | | carbonblack.edr.parent_process_guid | | keyword | | carbonblack.edr.parent_sha256 | | keyword | | carbonblack.edr.path | | keyword | | carbonblack.edr.pid | | long | | carbonblack.edr.port | | long | | carbonblack.edr.process_guid | | keyword | | carbonblack.edr.process_id | | keyword | | carbonblack.edr.process_name | | keyword | | carbonblack.edr.process_path | | keyword | | carbonblack.edr.process_unique_id | | keyword | | carbonblack.edr.protocol | | keyword | | carbonblack.edr.proxy | | boolean | | carbonblack.edr.regmod_count | | long | | carbonblack.edr.remote_ip | | keyword | | carbonblack.edr.remote_port | | long | | carbonblack.edr.report_id | | keyword | | carbonblack.edr.report_score | | long | | carbonblack.edr.requested_access | | long | | carbonblack.edr.scores.alliance_score_srstrust | | long | | carbonblack.edr.scores.alliance_score_virustotal | | long | | carbonblack.edr.script | | keyword | | carbonblack.edr.script_sha256 | | keyword | | carbonblack.edr.segment_id | | keyword | | carbonblack.edr.sensor_criticality | | double | | carbonblack.edr.sensor_id | | keyword | | carbonblack.edr.server_name | | keyword | | carbonblack.edr.sha256 | | keyword | | carbonblack.edr.size | | long | | carbonblack.edr.status | | keyword | | carbonblack.edr.tamper | | boolean | | carbonblack.edr.tamper_sent | | boolean | | carbonblack.edr.tamper_type | | keyword | | carbonblack.edr.target_create_time | | long | | carbonblack.edr.target_md5 | | keyword | | carbonblack.edr.target_path | | keyword | | carbonblack.edr.target_pid | | long | | carbonblack.edr.target_process_guid | | keyword | | carbonblack.edr.target_sha256 | | keyword | | carbonblack.edr.timestamp | | double | | carbonblack.edr.type | | keyword | | carbonblack.edr.uid | | keyword | | carbonblack.edr.unique_id | | keyword | | carbonblack.edr.username | | keyword | | carbonblack.edr.utf8_comments | | keyword | | carbonblack.edr.utf8_company_name | | keyword | | carbonblack.edr.utf8_copied_module_length | | long | | carbonblack.edr.utf8_file_description | | keyword | | carbonblack.edr.utf8_file_version | | keyword | | carbonblack.edr.utf8_internal_name | | keyword | | carbonblack.edr.utf8_legal_copyright | | keyword | | carbonblack.edr.utf8_legal_trademark | | keyword | | carbonblack.edr.utf8_on_disk_filename | | keyword | | carbonblack.edr.utf8_original_file_name | | keyword | | carbonblack.edr.utf8_private_build | | keyword | | carbonblack.edr.utf8_product_description | | keyword | | carbonblack.edr.utf8_product_name | | keyword | | carbonblack.edr.utf8_product_version | | keyword | | carbonblack.edr.utf8_special_build | | keyword | | carbonblack.edr.watchlist_id | | keyword | | carbonblack.edr.watchlist_name | | keyword | | carbonblack.edr.watchlists.watchlist_1 | | keyword | | carbonblack.edr.watchlists.watchlist_7 | | keyword | | carbonblack.edr.watchlists.watchlist_9 | | keyword | | data_stream.dataset | Data stream dataset name. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | host.containerized | If the host is a container. | boolean | | host.os.build | OS build information. | keyword | | host.os.codename | OS codename, if any. | keyword | | input.type | Type of Filebeat input. | keyword | | log.flags | Flags for the log file. | keyword | | log.offset | Offset of the entry in the log file. | long | | log.source.address | Source address from which the log event was read / sent from. | keyword | ## Changelog | Version | Details | Minimum Kibana version | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------| | **1.22.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/20572))Add tags to ingest pipeline processors. | 9.0.08.13.0 | | **1.21.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12919))Update Kibana constraint to support 9.0.0. | 9.0.08.13.0 | | **1.20.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/12697))Updated SSL description to be uniform and to include links to documentation. | 8.13.0 | | **1.20.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12503))Allow the usage of deprecated log input and support for stack 9.0 | 8.13.0 | | **1.19.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12046))Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". | 8.13.0 | | **1.18.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/11284))Use triple-brace Mustache templating when referencing variables in ingest pipelines. | 8.13.0 | | **1.18.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10135))Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. | 8.13.0 | | **1.17.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/9399))Update manifest format version to v3.0.3. | 8.0.07.14.0 | | **1.16.2** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8943))Changed owners | 8.0.07.14.0 | | **1.16.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/8635))Fix exclude_files pattern. | 8.0.07.14.0 | | **1.16.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8433))ECS version updated to 8.11.0. | 8.0.07.14.0 | | **1.15.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8025))Update the package format_version to 3.0.0. | 8.0.07.14.0 | | **1.14.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/7965))Removing unused ECS field declarations. | 8.0.07.14.0 | | **1.14.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7905))ECS version updated to 8.10.0. | 8.0.07.14.0 | | **1.13.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7789))Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. | 8.0.07.14.0 | | **1.12.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7107))Update package to ECS 8.9.0. | 8.0.07.14.0 | | **1.11.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6613))Ensure event.kind is correctly set for pipeline errors. | 8.0.07.14.0 | | **1.10.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6325))Update package to ECS 8.8.0. | 8.0.07.14.0 | | **1.9.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6135))Update package-spec version to 2.7.0. | 8.0.07.14.0 | | **1.8.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/5765))Update package to ECS 8.7.0. | 8.0.07.14.0 | | **1.7.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/5123))Added categories and/or subcategories. | 8.0.07.14.0 | | **1.7.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4576))Update package to ECS 8.6.0. | 8.0.07.14.0 | | **1.6.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4285))Update package to ECS 8.5.0. | 8.0.07.14.0 | | **1.5.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4339))Remove duplicate field. | 8.0.07.14.0 | | **1.5.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/3842))Update package to ECS 8.4.0 | 8.0.07.14.0 | | **1.4.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/3353))Update package to ECS 8.3.0. | 8.0.07.14.0 | | **1.3.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/3440))Add JA3/JA3S parsing | 8.0.07.14.0 | | **1.2.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/2778))Update to ECS 8.2 | 8.0.07.14.0 | | **1.1.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/2916))Add documentation for multi-fields | 8.0.07.14.0 | | **1.1.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/2385))Update to ECS 8.0 | 8.0.07.14.0 | | **1.0.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/2360))GA integration | 8.0.07.14.0 | | **0.3.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/2327))Change test public IPs to the supported subset | | | **0.3.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/2232))Add 8.0.0 version constraint | | | **0.2.2** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/1949))Update Title and Description. | | | **0.2.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/1801))Fix logic that checks for the 'forwarded' tag | | | **0.2.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/1651))Update to ECS 1.12.0 | | | **0.1.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/1527))initial release | |