Prerequisites
Carbon Black Defense API key with access level type.
Creating a credentials.psc file with the help of
cbapi-defense configureBinalyze AIR instance URL and webhook name and token.
Docker
A machine with Network Connection to Binalyze AIR and Carbon Black Cloud instances.
Configuration
Navigate to Carbon Black Cloud Console
Create API key
Navigate to Settings > API Keys > Add API Key
Create an API Key with Access Level SIEM and Copy both keys
API ID Connector ID
API Secret Key API Key
Create an Alert Notification
Navigate to **Settings > Notification > Add Notification
Fill in the necessary details
Select the Created API Key on the first step
Save
Navigate to Binalyze AIR Console
Create a webhook
Click Webhook on the left-hand pane
Click + New Webhook
Select Carbon Black Parser from Parser
Fill in all the necessary information and save
Copy the Webhook URL, and paste it to the value of AIR_WEBHOOK_URL in .env:1.
Navigate the environment you want to run the script
Create credentials.defense file
A credentials.defense file will be created and copy it to the current working directory.
Usage
Clone the repo
Follow the Configuration part and make the proper changes.
Run
docker build -t carbonblack-air-integration .and finallydocker run --env-file=.env carbonblack-air-integrationThe script will start running and will listen to new Carbon Black alerts. Once a new alert is detected, it will send an acquisition request to the specified Binalyze AIR instance.
A message appears when an acquisition request has been sent to the device.
If an error occurs, the script will print the error message and log it in the integration.log file.
Last updated
Was this helpful?