Source types for the Splunk Add-on for Carbon Black

The Splunk Add-on for Carbon Black collects notifications and event data from Carbon Black Response servers in JSON format through HEC or file monitoring and provides the following source type and event types.

The following table shows the CIM compliance by event type for source type bit9:carbonblack:json:

Event type	CIM compliance
bit9_carbonblack_alert	N/A
bit9_carbonblack_change_analysis	N/A
bit9_carbonblack_application_state	N/A
bit9_carbonblack_network	N/A
carbonblack_endpoint_processes	N/A
carbonblack_endpoint_filesystem	N/A
carbonblack_endpoint_registry	N/A
edr_carbonblack_alert	Alerts
edr_carbonblack_network	Network Traffic
edr_carbonblack_endpoint_processes	Endpoint
edr_carbonblack_endpoint_registry	Endpoint
edr_carbonblack_endpoint_filesystem	Endpoint
edr_carbonblack_all_changes	Change
edr_carbonblack_account_management	Change