Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Broadcom Carbon Black Cloud Collector

Before you configure the Broadcom Carbon Black Cloud Collector you must complete the following prerequisites.

Create the S3 Bucket

Use the following steps to create the S3 bucket for storing your data.

  1. Log in to the AWS console with your credentials.

  2. Locate the region selector, and select the same region where your Broadcom Carbon Black Cloud instance is located. This corresponds to the product URL you use for accessing Carbon Black Cloud. For more information, see Create an S3 Bucket in the AWS Console in the Carbon Black Cloud Console Documentation.

  3. Navigate to the S3 console and click Create bucket. For more information see Creating a Bucket in the AWS documentation. While creating a bucket, when you specify a name for your S3 bucket, ensure that the bucket name is unique and follows the Bucket naming rules mentioned by AWS. For example, mylogs.mycompanyname.

  4. After creating a bucket, add Carbon Black to the list of accounts that can read and write objects in your S3 bucket. For more information see Configuring ACLs.

    1. Access the AWS Console.

    2. In the Buckets list, click the name of the bucket for which you want to set permissions.

    3. Click Permissions.

    4. Scroll down to Access control list (ACL) section and click Edit.

      Prerequisites_1.png

    5. Click Add grantee.

      Prerequisites_2.png

    6. Enter our [email protected] canonical ID: c768943f39940f1a079ee0948ab692883824dcb6049cdf3d7725691bf4f31cbb.

      Prerequisites_3.png

    7. Enable both List and Write objects.

    8. Click Save changes.

Configure S3/SQS Integration

Use the following steps to configure the SQS queue that receives a notification when new objects are added to the S3 Bucket.

  1. In the AWS Web Console, navigate to the S3 bucket where the data is located.

  2. Under Properties, enable event notification for the SQS queue in the S3 bucket on which you want to receive logs.

    For more information, see Enable Event Notifications in the AWS documentation.

  3. To filter event notifications by suffix, enter a suffix. You can add suffix as .gz in the suffix option.

    Carbon_black_prerequisite.png

  4. Select All object create events to get notifications for all events.

    Carbon_black_Suffix_configuration.png

  5. Allow the S3 Bucket to send events to the SQS Queue.

  6. Replace the access policy attached to the queue with the following policy (in the SQS console, you select the queue, and in the Access policy tab, click Edit Access policy (Permissions).

    {
   "Version":"2012-10-17",
   "Id":"example-ID",
   "Statement":[
      {
         "Sid":"example-statement-ID",
         "Effect":"Allow",
         "Principal":{
            "AWS":"*"
         },
         "Action":[
            "SQS:SendMessage"
         ],
         "Resource":"SQS-queue-ARN",
         "Condition":{
            "ArnLike":{
               "aws:SourceArn":"arn:aws:s3:*:*:bucket-name"
            }
         }
      }
   ]
}

Set up the Data Forwarder

Carbon Black Cloud Data Forwarders let you send large volumes of data such as alerts, authentication events, endpoint activity and watchlist hits to external storage like AWS S3, Azure Blob Storage, or Google Cloud Storage.

For AWS S3, the Data Forwarder requires a bucket with a resource-based policy that grants access to the AWS Principal it uses. Use the AWS Management Console to create the bucket and configure permissions. For more information, see Option 1: Use AWS S3 in the Broadcom Carbon Black Cloud documentation.

The Data Forwarder forwards the data from Carbon Black servers into a customer managed S3 bucket, from which the cloud collector collects the data for ingestion. To set up S3 bucket, see create an S3 Bucket in the AWS Console.

Use the following steps to create and configure the Data Forwarder in the Carbon Black Cloud console.

  1. On the Carbon Black Cloud console, navigate to Settings > Data Forwarders.

  2. Click Add Forwarder.

  3. Specify a name for the Data Forwarder.

  4. Select the data forwarder type and provider. Then, add supporting information.

  5. Set the status to On or Off and save changes.

    The data forwarder is created. After configuring the data forwarder, you can fetch data from the provider or connect the collector. For more information about setting up a data forwarder, see Data Forwarders and Add a Data Forwarder in the Broadcom Carbon Black Cloud documentation.