Connecting to a Carbon Black CB Response data source
Connect the Carbon Black CB Response data source to IBM Security QRadar® Suite Software to enable your applications and dashboards to collect and analyze Carbon Black CB Response security data. Universal Data Insights connectors enable federated search across your security products.
Before you begin
If you have a firewall between your cluster and the data source target, use the IBM® Security Edge Gateway to host the containers. The Edge Gateway must be V1.6 or later. For more information, see Edge Gateway.
About this task
The IBM Security QRadar Suite Software connector for CB Response is designed to work with CB Response 7.3.0.
Structured Threat Information eXpression (STIX) is a language and serialization format that organizations use to exchange cyberthreat intelligence. The connector uses STIX patterning to query CB Response data and returns results as STIX objects. For more information about how the CB Response data schema maps to STIX, see Carbon Black CB Response stix-shifter repository (https://github.com/opencybersecurityalliance/stix-shifter/tree/develop/stix_shifter_modules/carbonblack).
- Log in to IBM Security QRadar Suite Software.
- From the menu, click .
- On the Data Sources tab, click Connect a data source.
- Click Carbon Black Response, then click Next.
- Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
- In the Data source name field, assign a
name to uniquely identify the data source connection. You can create multiple connection instances to a data source so it would be good to clearly set them apart by name. Only alphanumeric characters and the following special characters are allowed: - . _
- In the Data source description field,
write a description to indicate the purpose of the data source connection. You can create multiple connection instances to a data source, so it is useful to clearly indicate the purpose of each connection by description. Only alphanumeric characters and the following special characters are allowed: - . _
- If you have a firewall between your cluster and the data source target,
use the Edge Gateway to host the containers. In
the Edge gateway (optional) field, specify which Edge Gateway to use. Select an Edge Gateway to host the connectors that provide the communication between the data sources and QRadar Suite Software. It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
- If you want to include process events in the query results, check Include
Process Events?. When disabled, only process metadata is included.
- In the Management IP address or Hostname field, set the hostname or IP address of the data source so that QRadar Suite Software can communicate with it.
- In the Host Port field, set the port number that is associated with the data source host. The port is 443 by default.
- In the Data source name field, assign a name to uniquely identify the data source connection.
Set the query parameters to control the behavior of the search
query on the data source.
Important: If you increase the concurrent search limit and the result size limit, a greater amount of data can be sent from QRadar Suite Software, which increases the strain on the data sources. Increasing the query time range also increases the amount of data.
- In the Concurrent search limit field, set the number of simultaneous connections that can be made between QRadar Suite Software and the data source. The default limit for the number of connections is 4. The value must not be less than 1 and must not be greater than 100.
- In the Query search timeout limit field, set the time limit in minutes for how long the query is run on the data source. The default time limit is 30. When the value is set to zero, there is no timeout. The value must not be less than 1 and must not be greater than 120.
- In the Result size limit field, set the maximum number of entries or objects that are returned by search query. The default result size limit is 10,000. The value must not be less than 1 and must not be greater than 500,000.
- In the Query time range field, set the time range in minutes for the search, represented as the last X minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than 10,000.
- Optional: If CB Response is configured with a self-signed
Security Sockets Layer (SSL) certificate, add a connection certificate.
- To confirm that you have a self-signed certificate, you can search the web for 'ssl
decode', then copy and paste the certification into a Certificate Decoder. If the Common Name shows
localhost.localdomain, then it is a self-signed certificate. Otherwise, it is probably a publicly signed certificate.
- Copy the certificate details and paste it in the space that is provided, then click Done.
- To confirm that you have a self-signed certificate, you can search the web for 'ssl decode', then copy and paste the certification into a Certificate Decoder.
- Optional: If you need to customize the STIX attributes mapping, click Customize attribute mapping and edit the JSON blob to map new or existing properties to their associated target data source fields.
- Click Add a Configuration.
- Configure identity and access.
- Click Edit access and choose which users can connect to the data source and the type of access.
- In the Configuration description field, enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
- In the API Token field, enter the unique identifier of the data
source that you want to establish connection with. It is required to authenticate the connection
request. To obtain an API token:
- Go to your CB Response website and log
in to your account. The URL is usually of the form:
- Select the drop-down arrow next to your account name at the upper right of the page and select My Profile.
- On the left-side menu, select API Token.
- Copy the API token.
- Go to your CB Response website and log in to your account. The URL is usually of the form:
- Click Add.
- To save your configuration and establish the connection, click Done.
- To edit your configurations, complete the following steps:
- On the Data Sources tab, select the data source connection that you want to edit.
- In the Configurations section, click Edit Configuration ().
- Edit the identity and access parameters and click Save.
You can see the data source connection configuration that you added under Connections on the Data source settings page. A message on the card indicates connection with the data source.
What to do next
Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.
To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.