Overview ↵

About the Splunk Add-on for Carbon Black¶

Component	Description
Version	3.0.1
Visible in Splunk Web	No. This add-on does not contain views for configuration.
Vendor Product(s)	Carbon Black Response 4.2+, Carbon Black Response 6.3.1, Carbon Black EDR 7.4.0, Carbon Black EDR 7.6.1, Carbon Black EDR 7.8.1

Note

As of version 1.1.0, the Splunk Add-on for Bit9 Carbon Black is now called the Splunk Add-on for Carbon Black.

Use the Splunk Add-on for Carbon Black to collect notifications and event data in JSON format from Carbon Black Response servers over a pub/sub bus, and to collect watchlist hit, feed hit, new binary instance, and binary file upload complete notifications, as well as raw endpoint events.

Release notes¶

For a summary of new features, fixed issues, and known issues, and for more information on release history, see Release notes for the Splunk Add-on for Carbon Black.

Compatibility¶

This add-on provides the inputs and Common Information Model (CIM)-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance. For detailed information about compatibility with other software, CIM versions, and platforms, see the Release notes for the Splunk Add-on for Carbon Black.

Source types and lookups¶

For more information about the source types for Splunk Add-on for Carbon Black, see Source types.

Download the add-on¶

Download the Splunk Add-on for Carbon Black from Splunk Web or through the Splunk Enterprise UI.

Install and configure the add-on¶

To install and configure the Splunk Add-on for Carbon Black, see Installation and configuration overview for the Splunk Add-on for Carbon Black.

Hardware and software requirements¶

For more information, see Hardware and software requirements.

Additional resources¶

For more information, see Questions related to Splunk Add-on for Carbon Black on Splunk Answers.

See Troubleshooting guidelines specific for this add-on.

Hardware and software requirements for the Splunk Add-on for Carbon Black¶

Carbon Black requirements¶

This add-on consumes JSON event data produced by the Carbon Black Event Forwarder utility (cb-event-forwarder). The recommended collection method is to send events directly to a Splunk HTTP Event Collector (HEC) input. You can alternatively configure the Event Forwarder to write JSON files and use a Splunk file monitor to collect them.

Do not configure HEC and file monitoring for the same Event Forwarder output, because doing so duplicates data. The Event Forwarder and its installation instructions are available in the cb-event-forwarder GitHub repository.

Splunk platform requirements¶

Because this add-on runs on the Splunk platform, all of the system requirements apply for the Splunk software that you use to run this add-on.

Splunk Enterprise¶

For Splunk Enterprise system requirements, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.

Splunk Cloud Platform¶

If you are managing on-premises forwarders to get data into Splunk Cloud Platform, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual, which includes information about forwarders.

Installation and configuration overview for the Splunk Add-on for Carbon Black¶

To install and configure the Splunk Add-on for Carbon Black on your supported platform, complete the following steps:

Download the Splunk Add-on for Carbon Black
Install the Splunk Add-On for Carbon Black
Download the Carbon Black Event Forwarder utility
Configure your Carbon Black instance to generate and send events to Splunk

Ended: Overview

Installation and configuration ↵

Install the Splunk Add-on for Carbon Black¶

Use the tables below to determine where and how to install this add-on in a distributed deployment of Splunk Enterprise. See the installation walkthrough section at the bottom of this page for links to installation instructions specific to a single-instance deployment, distributed deployment, or Splunk Cloud Platform.

Distributed installation of this add-on¶

This table provides a quick reference for installing this add-on to a distributed deployment of Splunk Enterprise.

Splunk instance type	Supported	Required	Comments
Search Heads	Yes	Yes	Install this add-on to all search heads where Carbon Black knowledge management is required.
Indexers	Yes	Conditional	Not required if you use heavy forwarders to monitor Carbon Black data. Required if you use universal or light forwarders to collect data.
Heavy Forwarders	Yes	See comments	This add-on supports forwarders of any type for data collection. If installed on heavy forwarders, does not need to be installed on indexers.
Universal Forwarders	Yes	See comments	This add-on supports forwarders of any type for data collection. You must also install this add-on on your indexers if using universal forwarders.

Distributed deployment compatibility¶

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	You can install this add-on on a search head cluster for all search-time functionality. Configure inputs only on a forwarder to avoid duplicate data collection.
Indexer Clusters	Yes
Deployment Server	Yes	Supported for deploying the configured add-on.

Installation walkthrough¶

See About installing Splunk add-ons in Splunk Add-Ons for detailed instructions describing how to install a Splunk add-on in the following deployment scenarios:

Upgrade the Splunk Add-on for Carbon Black¶

The following upgrade steps provide a directory monitoring approach that ensures rolled-over JSON files are not missed if your Splunk platform deployment experiences downtime.

If your Splunk platform instance has been down, switching from file monitoring to directory monitoring can cause a temporary spike in ingestion while Splunk processes rolled-over files that accumulated during the downtime.

Change File Monitoring to Directory Monitoring¶

Download and install version 2.0.0 or higher of the Splunk Add-on for Carbon Black.
Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/local and open inputs.conf in a text editor.
Update the monitoring path:
- Change the existing path from <path_of_the_json_file> to <path_of_the_directory_containing_json_file>.
Add a whitelist parameter:
- Include whitelist = <regex_to_match_json_files>. Refer to the inputs.conf.template file in $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/default/ for guidance.
Replace <regex_to_match_json_files> with a regular expression to monitor the required JSON files. For example, .*\.json(\.[\d\-T:\.a-z]*)? matches the following files:
- event_bridge_output.json.2019-05-13T11:41:28.167.restart
- event_bridge_output.json.20190417
- event_bridge_output.json
Save your changes to the inputs.conf file.
Restart your data collection node to apply the changes.

Configure your Carbon Black instance to generate and send events to Splunk¶

Configure your Carbon Black instance to send JSON formatted data to Splunk:

Install the latest version of cb-event-forwarder, which is an open-source utility to send JSON formatted data to Splunk.
Follow the steps at cb-event-forwarder GitHub repository.

Though Carbon Black supports data collection using file monitoring or HEC, avoid file monitoring for data collection if possible. File monitoring requires the user to point to the location of individual JSON files, which can lead to errors. Do not configure HEC and file monitoring together, as this leads to data duplication.

Configure HEC inputs for the Splunk Add-on for Carbon Black¶

Configure HEC to ingest Carbon Black data.

Create a new HEC input from Splunk Web by following the steps in Set up and use HTTP Event Collector in Splunk Web. Set the source type to bit9:carbonblack:json, select the destination index, and save the generated HEC token.
Add a [splunk] stanza, if one is not already present, to cb-event-forwarder.conf. Set hec_token to the token from the previous step. For version 2.1.0 and later of this add-on, use the custom http_post_template shown below to separate raw events:
```
[splunk]
http_post_template={{range .Events}}{{.EventText}}"||"{{end}}
bundle_send_timeout = 60
upload_empty_files = false
bundle_size_max = 10485760
hec_token = <configured_hec_token>
```
The event forwarder verifies the HEC server certificate by default. If the HEC server certificate is signed by a private certificate authority, set ca_cert to the path of a PEM file that contains the trusted CA certificates. Do not disable certificate verification in a production environment.
Inside the same [splunk] stanza, set splunkout to the HEC raw endpoint:
```
splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw
```
If your HEC token has Indexer Acknowledgement enabled, add a unique GUID as the channel ID. Splunk uses this value to track acknowledgements:
```
splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw?channel=<unique_channel_id>
```
Restart the event forwarder and check for events.

Configure monitor inputs for the Splunk Add-on for Carbon Black¶

Configure a data collection node in the Splunk platform to monitor the JSON files generated by the Carbon Black Event Forwarder. See Hardware and software requirements for the Splunk Add-on for Carbon Black for information about this utility. You can use either Splunk Web to create monitor inputs or configure inputs.conf directly.

Configure Monitoring through Splunk Web¶

If you have access to Splunk Web on your data collection node, follow the steps:

Log into Splunk Web.
Navigate to Settings, then select Data inputs, and select Files & directories.
Select New.
Select Browse next to the File or Directory field and navigate to the directory where the Carbon Black Event Forwarder utility has generated the JSON file.
On the Whitelist page, add a regular expression so that Splunk Enterprise only monitors the required JSON files, then select Next. For example, .*\.json(\.[\d\-T:\.a-z]*)? will match the following types of files:
- event_bridge_output.json.2019-05-13T11:41:28.167.restart
- event_bridge_output.json.20190417
- event_bridge_output.json.
On the Sourcetype page, select Manual to enter a source type manually.
Type the following in the Sourcetype field: bit9:carbonblack:json.
Select Review.
After reviewing the information, select Submit.

After you configure monitoring, verify that data is being ingested into the Splunk platform by using the following search command to check that events are returned:

sourcetype=bit9:carbonblack:json

Configure inputs.conf¶

The Splunk Add-on for Carbon Black includes a file named inputs.conf.template that you can use as a template to create an inputs.conf file on your data collection node.

Copy the file named inputs.conf.template in the $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/default folder to the $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/local folder.

Open the inputs.conf.template file in a text editor. The contents look like this:

[monitor://<path_of_the_directory_containing_json_file>]
sourcetype = bit9:carbonblack:json
whitelist = <regex_to_match_json_files>

Replace <path_of_the_directory_containing_json_file> with the actual path of the directory where the JSON file is generated.
Replace <regex_to_match_json_files> with a regular expression to monitor the required JSON files. For example, .*\.json(\.[\d\-T:\.a-z]*)? will match the following types of files:
- event_bridge_output.json.2019-05-13T11:41:28.167.restart
- event_bridge_output.json.20190417
- event_bridge_output.json.
Rename the file to inputs.conf.
Restart your data collection node for the changes to take effect.

Once you configure monitoring, verify that data is being ingested into the Splunk platform by using the following search command to check that events are returned:

sourcetype=bit9:carbonblack:json

Ended: Installation and configuration

Troubleshooting ↵

Troubleshoot the Splunk Add-on for Carbon Black¶

For helpful troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons.

For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Unexpected HEC event wrapper¶

If the event received in Splunk has the following structure:

{
    "sourcetype": "<src_type>",
    "event": "<event>"
}

This structure indicates that the Carbon Black Event Forwarder is sending an HEC event wrapper instead of the delimiter-separated raw events expected by this add-on.

Solution¶

Verify that the [splunk] stanza in cb-event-forwarder.conf contains the following template:

http_post_template={{range .Events}}{{.EventText}}"||"{{end}}

Use the HEC raw endpoint with this template:

splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw

If your HEC token has Indexer Acknowledgement enabled, add a unique GUID as the channel ID. Splunk uses this value to track acknowledgements:

splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw?channel=<unique_channel_id>

After making the above changes, restart the Carbon Black Event Forwarder for the changes to take effect:

systemctl restart cb-event-forwarder

Ended: Troubleshooting

Reference ↵

Source types for the Splunk Add-on for Carbon Black¶

The Splunk Add-on for Carbon Black collects notifications and event data from Carbon Black Response servers in JSON format through HEC or file monitoring and provides the following source type and event types.

The following table shows the CIM compliance by event type for source type bit9:carbonblack:json:

Event type	CIM compliance
`bit9_carbonblack_alert`	N/A
`bit9_carbonblack_change_analysis`	N/A
`bit9_carbonblack_application_state`	N/A
`bit9_carbonblack_network`	N/A
`carbonblack_endpoint_processes`	N/A
`carbonblack_endpoint_filesystem`	N/A
`carbonblack_endpoint_registry`	N/A
`edr_carbonblack_alert`	Alerts
`edr_carbonblack_network`	Network Traffic
`edr_carbonblack_endpoint_processes`	Endpoint
`edr_carbonblack_endpoint_registry`	Endpoint
`edr_carbonblack_endpoint_filesystem`	Endpoint
`edr_carbonblack_all_changes`	Change
`edr_carbonblack_account_management`	Change

Lookups for the Splunk Add-on for Carbon Black¶

The Splunk Add-on for Carbon Black contains the following lookups.

Filename	Description
`bit9_cbs_actions.csv`	Maps `vendor_action` to `action`.
`bit9_cbs_description.csv`	Maps `vendor_type` to `description`.

Ended: Reference

Release Notes ↵

Release notes for the Splunk Add-on for Carbon Black¶

Version 3.0.1¶

Version 3.0.1 of the Splunk Add-on for Carbon Black was released on 19 October, 2026.

Compatibility¶

Version 3.0.1 of the Splunk Add-on for Carbon Black is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.3.x, 9.4.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x, 10.4.x, 10.5.x, 10.6.x
CIM	8.7.0
Platforms	Platform independent
Vendor products	Carbon Black Response 4.2, Carbon Black Response 6.3.1, Carbon Black EDR 7.4.0, Carbon Black EDR 7.6.1, Carbon Black EDR 7.8.1

Carbon Black EDR ingress.event.netconn events do not supply network-zone identifiers. The add-on does not populate the CIM src_zone and dest_zone fields or infer zones from IP addresses or traffic direction. Searches that require these fields need customer-specific IP-to-zone enrichment. CIM 8.7 compatibility does not imply that these source-dependent fields are populated.

Fixed issues¶

Version 3.0.1 of the Splunk Add-on for Carbon Black fixes the following issues:

Issue	Description
ADDON-82978	Corrected Account Management mappings to the Change data model and normalized successful user activity events with HTTP status codes `200`, `201`, and `204` to CIM `status=success`.
ADDON-89984	Corrected inbound `ingress.event.netconn` events so that `src` and `src_ip` both identify the remote source. Outbound network-event mappings are unchanged.

The corrected Account Management mappings cover the following bit9:carbonblack:json events:

Event Name	CIM data model supported in this release
type=audit.log.useractivity path=”/api/user” method=”POST”	Change:Account_Management
type=audit.log.useractivity path=”/api/user/<username>” method=”PUT”	Change:Account_Management
type=audit.log.useractivity path=”/api/user/<username>” method=”DELETE”	Change:Account_Management

Carbon Black EDR records user creation, update, and deletion requests in useractivity.log only when EnableExtendedApiAuditLogging=true. The Carbon Black Event Forwarder must also be configured with audit_log=true to forward these events.

The HEC configuration and troubleshooting guidance now uses the raw endpoint with the add-on’s delimiter-separated payload and preserves TLS certificate verification.

Known issues¶

Known issues reported for version 3.0.1 of the Splunk Add-on for Carbon Black are listed below.

Third-party software attributions¶

The third-party software report for version 3.0.1 lists no dependencies.

Version 3.0.0¶

Version 3.0.0 of the Splunk Add-on for Carbon Black was released on .

Compatibility¶

Version 3.0.0 of the Splunk Add-on for Carbon Black is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.x, 10.x
CIM	6.1.0
Platforms	Platform independent
Vendor products	Carbon Black Response 4.2, Carbon Black Response 6.3.1, Carbon Black Response 7.4.0, Carbon Black EDR 7.6.1, Carbon Black EDR 7.8.1

New features¶

The following new features were implemented:

Introduced a built-in dashboard that displays:
- The installed add-on version
- The total number of Carbon Black events ingested into Splunk
- A time-series graph showing Carbon Black events ingested into Splunk
- The count of events ingested from selected indexes, sources, and event types
- Event trends categorized by index
- CIM-supported events
Support for the newest version of CIM v6.1.0
Support for latest product version Carbon Black EDR 7.8.1
Version 3.0.0 is IPv6 compliant, ensuring compatibility with IPv6-based Splunk deployments.
Added CIM support to the new events in sourcetype bit9:carbonblack:json. The new events are listed in the table below along with their supported CIM data models:

Event Name	CIM data model supported in this release
type=audit.log.useractivity path=”/api/logout” method=”GET”	Change:Account_Management
type=feed.query.hit.process feed_name=cbcommunity	Alerts
type=alert.watchlist.hit.query.process watchlist_name=Newly Installed Applications	Alerts
type=task.error.logged	Alerts

Breaking Changes¶

The data models of some of the events have been changed in the release v3.0.0. Details are mentioned in the table below:

Source Type	Event Name	Old Data Model	New Data Model
bit9:carbonblack:json	type=binarystore.file.added	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=watchlist.storage.hit.binary watchlist_name=Newly Loaded Modules	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=watchlist.storage.hit.binary watchlist_name=Newly Executed Applications	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=binaryinfo.observed	No DM	Alerts
bit9:carbonblack:json	type=binaryinfo.group.observed	No DM	Alerts
bit9:carbonblack:json	type=binaryinfo.host.observed	No DM	Endpoint:Filesystem
bit9:carbonblack:json	type=watchlist.hit.binary digsig_result=Signed watchlist_name=Newly Loaded Modules	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=watchlist.hit.binary digsig_result=Unsigned watchlist_name=Newly Executed Applications	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=watchlist.hit.binary digsig_result=Signed watchlist_name=Newly Executed Applications	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=feed.synchronized	No DM	Alerts
bit9:carbonblack:json	type=feed.query.hit.process feed_name=bit9endpointvisibility	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=feed.query.hit.process feed_name=attackframework	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=feed.query.hit.process feed_name=bit9suspiciousindicators	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=feed.storage.hit.process feed_name=bit9endpointvisibility	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=feed.storage.hit.process feed_name=attackframework	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=feed.storage.hit.process feed_name=bit9suspiciousindicators	Endpoint:Processes	Alerts
bit9:carbonblack:json	type=watchlist.hit.binary digsig_result=Unsigned watchlist_name=Newly Loaded Modules	Endpoint:Filesystem	Alerts
bit9:carbonblack:json	type=audit.log.useractivity path=”/api/auth” method=”POST”	No DM	Change:All_Changes
bit9:carbonblack:json	type=audit.log.useractivity path=”/api/v1/settings/global/advanced” method=”GET”	No DM	Change:All_Changes
bit9:carbonblack:json	type=audit.log.useractivity path=”/api/v1/settings/global/advanced” method=”POST”	No DM	Change:All_Changes

Fields extraction of some of the events have been changed in the release 3.0.0. Details are mentioned in the table below

Source Type	Event Name	Fields Changed
bit9:carbonblack:json	type=watchlist.storage.hit.process watchlist_name=Autoruns	dest, process_hash
bit9:carbonblack:json	type=ingress.event.childproc childproc_type=Exec	os, parent_process, parent_process_exec, parent_process_id, parent_process_name, parent_process_path, process, process_current_directory, process_exec, process_hash, process_guid, process_id, process_name, process_path
bit9:carbonblack:json	type=ingress.event.moduleload	original_file_name, os, parent_process, parent_process_exec, parent_process_id, parent_process_guid, parent_process_name, parent_process_path, process, process_current_directory, process_exec, process_hash, process_guid, process_id, process_name, process_path
bit9:carbonblack:json	type=ingress.event.procstart	os, parent_process, process_hash
bit9:carbonblack:json	type=ingress.event.netconn direction=outbound	app, src_ip, src_translated_ip
bit9:carbonblack:json	type=ingress.event.netconn direction=inbound	app, src_ip, src_translated_ip, transport
bit9:carbonblack:json	type=ingress.event.module digsig.result=Signed	action, file_name, file_path
bit9:carbonblack:json	type=ingress.event.module digsig.result=Unsigned	action, file_name, file_path
bit9:carbonblack:json	type=watchlist.storage.hit.process watchlist_name=Non-System Filemods to system32	dest, process_hash
bit9:carbonblack:json	type=ingress.event.remotethread	os, parent_process, parent_process_exec, parent_process_id, parent_process_guid, parent_process_name, parent_process_path, process, process_exec, process_hash, process_guid, process_id, process_name, process_path
bit9:carbonblack:json	type=watchlist.storage.hit.process watchlist_name=Newly Installed Applications	dest, process_hash
bit9:carbonblack:json	type=alert.watchlist.hit.query.binary digsig_result=Unsigned	description, dest, dest_type, signature, signature_id, src_type
bit9:carbonblack:json	type=alert.watchlist.hit.query.binary digsig_result=Signed	description, dest, dest_type, signature, signature_id, src_type
bit9:carbonblack:json	type=ingress.event.crossprocopen cross_process_type=open_process	os, parent_process, parent_process_exec, parent_process_id, parent_process_guid, parent_process_name, parent_process_path, process, process_exec, process_hash, process_guid, process_id, process_name, process_path
bit9:carbonblack:json	type=ingress.event.crossprocopen cross_process_type=open_thread	os, parent_process, parent_process_exec, parent_process_id, parent_process_guid, parent_process_name, parent_process_path, process, process_exec, process_hash, process_guid, process_id, process_name, process_path
bit9:carbonblack:json	type=ingress.event.procend	action, os, parent_process_guid, process
bit9:carbonblack:json	type=ingress.event.childproc childproc_type=Fork	os, parent_process, parent_process_exec, parent_process_id, parent_process_name, parent_process_path, process
bit9:carbonblack:json	type=ingress.event.childproc childproc_type=OtherExec	os, parent_process, parent_process_exec, parent_process_id, parent_process_name, parent_process_path, process
bit9:carbonblack:json	type=alert.watchlist.hit.query.process watchlist_name:Autoruns	description, dest, signature, signature_id, src_type
bit9:carbonblack:json	type=ingress.event.regmod action=createkey	registry_hive

Fixed issues¶

Version 3.0.0 of the Splunk Add-on for Carbon Black fixes the following issues. If no issue appear, then there are no bug fixes reported.

Known issues¶

Version 3.0.0 of the Splunk Add-on for Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 3.0.0 of the Splunk Add-on for Carbon Black incorporates the following third-party software or libraries.

Release history for the Splunk Add-on for Carbon Black¶

Version 3.0.1 is the most recent version of the Splunk Add-on for Carbon Black. See the latest Release notes topic for more information.

Version 3.0.0¶

Version 3.0.0 introduced a built-in dashboard, support for CIM 6.1.0 and Carbon Black EDR 7.8.1, IPv6 compatibility, and expanded CIM mappings. See the 3.0.0 release notes for details.

Version 2.1.0¶

Version 2.1.0 of the Splunk Add-on for Carbon Black was released on March 7, 2022.

Compatibility¶

Version 2.1.0 of the Splunk Add-on for Carbon Black is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.1.x, 8.2.x
CIM	5.0.0
Platforms	Platform independent
Vendor products	Carbon Black Response 4.2, Carbon Black Response 6.3.1, Carbon Black Response 7.4.0, Carbon Black EDR 7.6.1

New features¶

Added support for the latest Carbon Black EDR version v7.6.1.
Provided compatibility with the latest CIM version v5.0.0.
Fixed the _time field extraction issue when data is collected over HEC. Previously, _time indicated the ingestion time of the event. As of this version, the actual timestamp value in the event is used.
Fixed extraction for the file_path field to extract with a single slash instead of double slashes.
Corrected the user field extraction by removing incorrect values for some events.

Fixed issues¶

Version 2.1.0 of the Splunk Add-on for Carbon Black fixes the following issues. If no issue appear, then there are no bug fixes reported.

Known issues¶

Version 2.1.0 of the Splunk Add-on for Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 2.1.0 of the Splunk Add-on for Carbon Black incorporates the following third-party software or libraries.

Version 2.0.0¶

Version 2.0.0 of the Splunk Add-on for Carbon Black was released on May 8, 2021

Compatibility¶

Version 2.0.0 is compatible with the following software, CIM versions, and platforms.


Splunk platform versions	7.3.x, 8.0.x, 8.1.x
CIM	4.18.1
Platforms	Platform independent
Vendor Products	Carbon Black Response 4.2, Carbon Black Response 6.3.1, Carbon Black Response 7.4.0

New features¶

Compatibility for Carbon Black Response Server 7.4.0
Compatibility for cb-event-forwarder 3.7.4
Compatibility for CIM 4.18.1
CIM field process & process_exec & process_name will have the same value if the events contains only process_path.
Extraction for CIM field registry_path has been fixed in the latest release 2.0.0.
Extraction for CIM field process_pid has been fixed in the latest release 2.0.0.
New CIM field mapping process_hash has been added in this release and a non CIM field parent_process_hash added to capture the md5 hash of the parent process.
Starting with version 2.0.0, the tagging has been modified and updated as per the following table:

Event type	Data model
bit9_carbonblack_alert
bit9_carbonblack_change_analysis
bit9_carbonblack_application_state
bit9_carbonblack_network
carbonblack_endpoint_processes
carbonblack_endpoint_processes
carbonblack_endpoint_filesystem
carbonblack_endpoint_registry
edr_carbonblack_alert	Alert
edr_carbonblack_network	Network Traffic
edr_carbonblack_endpoint_processes	Endpoint Processes
edr_carbonblack_endpoint_registry	Endpoint Registry
edr_carbonblack_endpoint_filesystem	Endpoint Filesystem

As of version 2.0.0, the values for product and vendor_product are as follows:

Field	Value in version 1.1.0	Value in version 2.0.0
product	CB Response	EDR
vendor_product	Carbon Black CB Response	Carbon Black EDR

Fixed issues¶

Version 2.0.0 of the Splunk Add-on for Carbon Black fixes the following issues. If no issue appear, then there are no bug fixes reported.

Known issues¶

Version 2.0.0 of the Splunk Add-on for Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 2.0.0 of the Splunk Add-on for Carbon Black does not incorporate any third-party software or libraries.

Version 1.1.0¶

Compatibility¶

Version 1.1.0 of the Splunk Add-on for Carbon Black is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	6.6.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x
CIM	4.13
Platforms	Platform independent
Vendor Products	Carbon Black Response 4.2+, Carbon Black Response 6.3.1

New features¶

Improved load balancing on the universal forwarder
Compatibility for Carbon Black Response Server 6.3.1
Compatibility for cb-event-forwarder 3.5.0
Compatibility for CIM 4.13
Updated inputs.conf.template to monitor directory instead of file
Starting in version 1.1.0, the values for vendor, product and vendor_product have been updated as below:-

Field	Value in version 1.0.1	Value in version 1.1.0
vendor	Bit9	Carbon Black
product	Carbon Black	CB Response
vendor_product	Bit9 Carbon Black	Carbon Black CB Response

Fixed issues¶

Version 1.1.0 of the Splunk Add-on for Carbon Black fixes the following issues. If no issue appear, then there are no bug fixes reported.

Known issues¶

Version 1.1.0 of the Splunk Add-on for Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 1.1.0 of the Splunk Add-on for Carbon Black does not incorporate any third-party software or libraries.

Version 1.0.1¶

Compatibility¶

Version 1.0.1 of the Splunk Add-on for Bit9 Carbon Black is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	6.6.x, 7.0.x, 7.1.x, 7.2.x
CIM	4.11
Platforms	Platform independent
Vendor Products	Carbon Black Server (CBS) 4.2 or later

Fixed issues¶

Version 1.0.1 of the Splunk Add-on for Bit9 Carbon Black fixes the following issues. If no issue appear, then there are no bug fixes reported.

Known issues¶

Version 1.0.1 of the Splunk Add-on for Bit9 Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 1.0.1 of the Splunk Add-on for Splunk Add-on for Bit9 Carbon Black does not incorporate any third-party software or libraries.

Version 1.0.0¶

Compatibility¶

Version 1.0.0 of the Splunk Add-on for Bit9 Carbon Black has the same compatibility specifications as version 1.0.1.

New features¶

Version 1.0.0 of the Splunk Add-on for Bit9 Carbon Black has the following new features.

Known issues¶

Version 1.0.0 of the Splunk Add-on for Bit9 Carbon Black contains the following known issues. If no issues appear, no issues have yet been reported.

Third-party software attributions¶

Version 1.0.0 of the Splunk Add-on for Splunk Add-on for Bit9 Carbon Black does not incorporate any third-party software or libraries.

Third-party credits¶

The FOSSA third-party software report for version 3.0.1 lists no dependencies.