|
1 | 1 | --- |
2 | 2 | id: carbon-black |
3 | | -title: Carbon Black Cloud - Cloud SIEM |
| 3 | +title: Ingest Carbon Black Cloud Data into Cloud SIEM |
4 | 4 | sidebar_label: Carbon Black Cloud |
5 | 5 | description: Configure collection of Carbon Black Cloud logs messages from an S3 bucket to be parsed by Cloud SIEM's system parser for Carbon Black Cloud. |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | import useBaseUrl from '@docusaurus/useBaseUrl'; |
9 | 9 |
|
10 | | -This page has instructions for collecting Carbon Black Cloud log messages and sending them to Sumo Logic to be ingested by Cloud SIEM. |
11 | | - |
12 | | -VMware does NOT recommend setting up a Cloud-to-Cloud integration for Carbon Black Cloud and instead recommends collecting logs in an S3 bucket as an intermediary, as described below. |
13 | | - |
14 | | - |
15 | | -### Step 1: Configure collection |
16 | | - |
17 | | -In this step, you configure an AWS S3 Source to collect Carbon Black Cloud log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure an AWS S3 Source below](#configure-an-aws-s3-source). Otherwise, create a new collector as described in Configure a hosted collector below, and then create the source on the collector. |
18 | | - |
19 | | - |
20 | | -#### Configure a hosted collector |
21 | | - |
22 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
23 | | -2. Click **Add Collector**. |
24 | | -3. Click **Hosted Collector.** |
25 | | -4. The **Add Hosted Collector ** popup appears.< br/><img src={useBaseUrl('img/cse/add-hosted-collector.png')} alt="Add Hosted Collector dialog" style={{border: '1px solid gray'}} width="500" /> |
26 | | -5. **Name**. Provide a Name for the Collector. |
27 | | -6. **Description**. (Optional) |
28 | | -7. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
29 | | -8. **Fields**. |
30 | | - 1. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is _true_. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM. |
31 | | - 2. If all sources in this collector will be Carbon Black Cloud sources, add an additional field with key `_parser` and value _/Parsers/System/VMware/Carbon Black Cloud_. |
32 | | - |
33 | | - |
34 | | -It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section. |
35 | | - |
36 | | - |
37 | | -#### Configure an AWS S3 Source |
38 | | - |
39 | | -If you have issues performing the steps below, see the [AWS S3 Source](/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source) topic for more information. |
40 | | - |
41 | | -The bucket you designate for Carbon Black Cloud data must be exclusively used for this data source. Note also that the Sumo Logic collector does not support collection of logs that are edited after being stored in S3 and prior to being polled for ingestion to the Sumo Logic core platform. |
42 | | - |
43 | | -1. [Grant Sumo Logic access](/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product) to an Amazon S3 bucket. |
44 | | -2. [Enable logging in AWS](http://docs.aws.amazon.com/AmazonS3/latest/dev/enable-logging-console.html) using the Amazon Console. |
45 | | -3. Confirm that logs are being delivered to the Amazon S3 bucket. |
46 | | -4. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
47 | | -5. Navigate to the Hosted Collector where you want to create the source. |
48 | | -6. On the **Collectors** page, click **Add Source** next to a Hosted Collector. |
49 | | -7. Select **Amazon S3**. |
50 | | -8. The page refreshes.< br/> <img src={useBaseUrl('img/cse/s3-source.png')} alt="Add Hosted Collector dialog" style={{border: '1px solid gray'}} width="600" /> |
51 | | -9. **Name**. Enter a name for the source. |
52 | | -10. **Description**. (Optional) |
53 | | -11. **S3 Region**. Choose the AWS Region the S3 bucket resides in. |
54 | | -12. **Use AWS versioned APIs?** Leave the default, _Yes_. |
55 | | -13. **Bucket Name**. The name of your organization.s S3 bucket as it appears in AWS. |
56 | | -14. **Path Expression**. The path expression of the log file(s) in S3, can contain wildcards to include multiple log files. |
57 | | -15. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
58 | | -16. **Fields**. |
59 | | - * If you are not forwarding all sources in the hosted collector to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is _true_. This will ensure all logs for this source are forwarded to Cloud SIEM. |
60 | | - * Add another field named `_parser` with value _/Parsers/System/VMware/Carbon Black Cloud_ |
61 | | -17. **AWS Access**. For AWS Access you have two Access Method options. Select **Role-based access** or **Key access** based on the AWS authentication you are providing. Role-based access is preferred. Note that Sumo Logic access to AWS (instructions are provided above in [Step 1](#step-1-configure-collection)) is a prerequisite for role-based access |
62 | | - * **Role-based access **. Enter the Role ARN that was provided by AWS after creating the role.< br/> <img src={useBaseUrl('img/cse/role-arn.png')} alt="Role ARN field" style={{border: '1px solid gray'}} width="500" /> |
63 | | - * **Key access**. Enter the Access Key ID and Secret Access Key. See [AWS Access Key ID](http://docs.aws.amazon.com/STS/latest/UsingSTS/UsingTokens.html#RequestWithSTS) and [AWS Secret Access Key](https://aws.amazon.com/iam/) for details. |
64 | | -18. **Log File Discovery**. These settings allow Sumo Logic to automatically collect logs from the specified S3 bucket when an Amazon SNS message is received (highly recommended). Alternatively, an automatic scan interval for new log files can be configured. |
65 | | -19. **Advanced Options for Logs.** For information about the optional advanced options you can configure, see [AWS S3 Source](/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source). |
66 | | -20. Click **Save**. |
67 | | - |
68 | | - |
69 | | -### Step 2: Configure Carbon Black Cloud |
70 | | - |
71 | | -In this step you configure Carbon Black Cloud to send log messages to an S3 bucket. For instructions, see [Data Forwarders](https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-E8D33F72-BABB-4157-A908-D8BBDB5AF349.html) in VMware help. |
72 | | - |
73 | | - |
74 | | -### Step 3: Verify ingestion |
75 | | - |
76 | | -In this step, you verify that your logs are successfully making it into Cloud SIEM. |
77 | | - |
78 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
79 | | -2. On the **Log Mappings** tab search for Carbon Black Cloud and check the **Records** columns. |
80 | | -3. For a more granular look at the incoming records, you can also search Sumo Logic for Carbon Black Cloud records.< br/> <img src={useBaseUrl('img/cse/carbon-black-search.png')} alt="A Carbon Black query" style={{border: '1px solid gray'}} width="500" /> |
| 10 | +To ingest Carbon Black Cloud data into Cloud SIEM: |
| 11 | +1. [Configure a source for Carbon Black Cloud](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source/#source-configuration) on a collector. When you configure the source, do the following: |
| 12 | + 1. Select the [**Forward to SIEM** option](/docs/c2c/info/#metadata-fields) in the source configuration UI. This will ensure all logs for this source are forwarded to Cloud SIEM. |
| 13 | + 1. Click the **+Add** link to add a field whose name is `_parser` with value */Parsers/System/VMware/Carbon Black Cloud*. This ensures that the Carbon Black Cloud logs are parsed and normalized into structured records in Cloud SIEM. |
| 14 | +1. To verify that your logs are successfully making it into Cloud SIEM: |
| 15 | + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
| 16 | + 1. On the **Log Mappings** tab search for Carbon Black Cloud and check the **Records** columns. |
| 17 | + 1. For a more granular look at the incoming records, you can also search Sumo Logic for Carbon Black Cloud records.< br/> <img src={useBaseUrl('img/cse/carbon-black-search.png')} alt="A Carbon Black query" style={{border: '1px solid gray'}} width="500" /> |
0 commit comments