Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The VMware Carbon Black EDR On Premise action bundle enriches indicators and assets in a data collection with information found in VMWare Carbon Black EDR On Premise instances.

WMWare Carbon Black EDR is used to record and save endpoint activity data. Security analysts can use this data to find in real time potential threats.

The integration provides the following actions:

• VMware Carbon Black EDR On Premise - Process Enrichment - queries data regarding processes.
• VMware Carbon Black EDR On Premise - Binary Enrichment - queries data regarding binaries.
• VMware Carbon Black EDR On Premise - Alert Enrichment - queries data regarding alerts.
• VMware Carbon Black EDR On Premise - Manage Banned Hashes - manages the ban status of hashes.
• VMware Carbon Black EDR on Premise - Manage Approved IP Addresses - manages the IP Addresses from the approved list.  

The integration is compatible with the following object types:

• Assets
• Indicators

The integration returns the following enriched system objects:

• Assets
• Indicators

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• An VMware Carbon Black EDR On Premise instance.
• An VMware Carbon Black EDR API Token - see https://developer.carbonblack.com/reference/enterprise-response/authentication/ for more information.  
• An active ThreatQ TDR Orchestrator (TQO) license.
• A data collection containing at least one of the following object types:
  • Asset
  • Indicator

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the action zip file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the action zip file using one of the following methods:
   • Drag and drop the zip file into the dialog box
   • Select Click to Browse to locate the zip file on your local machine
6. Select the actions to install, when prompted, and then click on Install.

   ThreatQ will inform you if the action already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the action contains changes to the user configuration. The new user configurations will overwrite the existing ones for the action and will require user confirmation before proceeding.

The action(s) have now been installed on your ThreatQ instance.  You will still need to configure the action(s).

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Process Enrichment Parameters

   Parameter	Description
   Carbon Black EDR URL	Specify full URL to the Carbon Black EDR instance.  The format is https://<hostname>:<port>.
   Carbon Black EDR API Token	The API Token used to connect to Carbon Black EDR instance.
   Disable Proxies	Enable this parameter if the action should not honor the proxies set in ThreatQ.
   Enable SSL Verification	When enabled, the action validates the host-provided SSL certificate.  This option is enabled by default.
   Max Results	Enter the maximum number of results to return per indicator/asset.  The value you enter will round to the nearest 100.  Example: if you enter 180, the integration will ingest 200.
   Additional Search Query	Specify additional query criteria. The default query contains only the input value of the indicator/asset. Accepts the same data as the search box on the Process Search page. (e.g start:-1h and group:"default group")
   Attribute Filter	Select the pieces of context to ingest into the ThreatQ platform when a record is found.  Options include:  Process Name Parent Name Host Type Command Line Last Update Modloads Regmods Filemods Netconns Fileless Scriptloads Children Carbon Black EDR Group Operating System
   Related Objects Filter	Select the related objects to ingest into ThreatQ when a record is found.  Options include: Process MD5 (Indicator) Process Path (Indicator) Username (Indicator) Hostname (Asset)
   Objects Per Run	The number of objects to process per run of the workflow.

   
   

   Binary Enrichment Parameters

   Parameter	Description
   Carbon Black EDR URL	Specify full URL to the Carbon Black EDR instance.  The format is: https://<hostname>:<port>.
   Carbon Black EDR API Token	The API Token used to connect to Carbon Black EDR instance.
   Disable Proxies	Enable this parameter if the action should not honor the proxies set in ThreatQ.
   Enable SSL Verification	When enabled, the action validates the host-provided SSL certificate.  This option is enabled by default.
   Max Results	Enter the maximum number of results to return per indicator/asset. For values greater than 100 it will be the closest greater multiple of 100.
   Additional Search Query	Specify additional query criteria. The default query contains only the input value of the indicator/asset. Accepts the same data as the search box on the Process Search page. (e.g start:-1h and group:"default group")
   Attribute Filter	Select the pieces of context to ingest into the ThreatQ platform when a record is found.  Options include:  File Size Is Executable Product Version Product Name Company Signed Status Signature Issuer Signature Publisher Virustotal Score Operating System Hosts Count
   Objects Per Run	The number of objects to process per run of the workflow

   
   

   Alert Enrichment Parameters

   Parameter	Description
   Carbon Black EDR URL	Specify full URL to the Carbon Black EDR instance.  The format is: https://<hostname>:<port>.
   Carbon Black EDR API Token	The API Token used to connect to Carbon Black EDR instance.
   Disable Proxies	If true, specifies that this feed should not honor any proxies setup in ThreatQuotient
   Enable SSL Verification	When checked, validates the host-provided SSL certificate. Checked by default
   Max Results	Enter the maximum number of results to return per indicator/asset. For values greater than 100 it will be the closest greater multiple of 100
   Additional Search Query	Specify additional query criteria. The default query contains only the input value of the indicator/asset. Accepts the same data as the search box on the Process Search page. (e.g start:-1h and group:"default group")
   Attribute Filter	Select the pieces of context to ingest into the ThreatQ platform when a record is found.  Options include:  Alert Type Criticality Feed Rating IoC Confidence Report Score Operating System Severity Hosts Count Modloads Regmods Filemods Netconns Fileless Scriptloads Children Signed Status Process Name
   Related Objects Filter	Select the related objects to ingest into the ThreatQ platform when a record is found.  Options include: MD5 Filename File Path Username Hostname (Asset)
   Objects Per Run	The number of objects to process per run of the workflow

   
   

   Manage Banned Hashes Parameters

   Parameter	Description
   Carbon Black EDR URL	Specify full URL to the Carbon Black EDR instance.  The format is: https://<hostname>:<port>.
   Carbon Black EDR API Token	The API Token used to connect to Carbon Black EDR instance.
   Disable Proxies	If true, specifies that this feed should not honor any proxies setup in ThreatQuotient
   Enable SSL Verification	When checked, validates the host-provided SSL certificate. Checked by default
   Ban Status	Select the status of the ban. Options include: Ban Hash Disable Hash Ban
   Banned Hash Notes	Enter the notes to add for each banned hash.
   Objects Per Run	The number of objects to process per run of the workflow

   
   

   Manage Approved IP Addresses Parameters

   Parameter	Description
   Carbon Black EDR URL	Specify full URL to the Carbon Black EDR instance.  The format is: https://<hostname>:<port>.
   Carbon Black EDR API Token	The API Token used to connect to Carbon Black EDR instance.
   Disable Proxies	If true, specifies that this feed should not honor any proxies setup in ThreatQuotient
   Enable SSL Verification	When checked, validates the host-provided SSL certificate. Checked by default
   Action	Select the action to perform for each IP Address. Options include: Add to Approved List Remove from Approved List
   Objects Per Run	The number of objects to process per run of the workflow

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The following actions are available:

{
   "q": "f34217144e41c2a0ea56df7056f0b4d7 and (start:-1h and group:\"default group\")"
}

{
  "results": [
    {
      "unique_id": "00000005-0015-ab5c-01db-2386a75d5e87-0192ade246f5",
      "parent_unique_id": "00000005-ffff-ffff-0000-000000000000-000000000001",
      "id": "00000005-0015-ab5c-01db-2386a75d5e87",
      "parent_id": "00000005-ffff-ffff-0000-000000000000",
      "path": "/usr/sbin/xtables-nft-multi",
      "process_name": "xtables-nft-multi",
      "process_md5": "6efe836697311c356a7db2f39e1ac6a2",
      "parent_name": "runc",
      "parent_md5": "00000000000000000000000000000000",
      "hostname": "workstation1",
      "host_type": "workstation",
      "os_type": "linux",
      "start": "2024-10-21T06:58:37.806Z",
      "last_update": "2024-10-21T06:58:37.806Z",
      "last_server_update": "2024-10-21T07:02:20.780Z",
      "sensor_id": 5,
      "group": "int_7535",
      "segment_id": 1729494140661,
      "username": "root",
      "cmdline": "/usr/sbin/iptables -t filter -S FLANNEL-FWD 1 --wait",
      "process_pid": 1420124,
      "parent_pid": -1,
      "comms_ip": 175178466,
      "interface_ip": 175178466,
      "emet_config": "",
      "terminated": false,
      "filtering_known_dlls": false,
      "logon_type": -1,
      "tampered": false,
      "regmod_count": 1,
      "netconn_count": 2,
      "filemod_count": 3,
      "modload_count": 4,
      "childproc_count": 5,
      "crossproc_count": 0,
      "emet_count": 0,
      "processblock_count": 0,
      "fileless_scriptload_count": 6
    }
  ],
  "elapsed": 0.043074607849121094,
  "all_segments": true,
  "comprehensive_search": true,
  "start": 0,
  "total_results": 6066,
  "terms": [
    "username:root",
    "start:-1h",
    "group:\"int_7535\""
  ],
  "tagged_pids": {},
  "incomplete_results": false
}

{
   "q": "f34217144e41c2a0ea56df7056f0b4d7 and (digsig_result:Unsigned)"
}

{
  "results": [
    {
      "md5": "A92ACA8CE49D71D26B5853D0442A7473",
      "sha256": "1ff597e8bd590896c17d856188d1f0950a5a4cf4e7d2c0b40a6c1eb95c9586b3",
      "signed": "Unsigned",
      "timestamp": "2024-10-17T10:22:17.771Z",
      "company_name": "Windows",
      "product_name": "Microsoft Office Word",
      "original_filename": "(unknown)",
      "observed_filename": [
        "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2"
      ],
      "internal_name": "(unknown)",
      "product_version": "6.3.9200",
      "file_version": "(unknown)",
      "file_desc": "Documents editor",
      "server_added_timestamp": "2024-10-17T10:22:17.771Z",
      "copied_mod_len": 122480,
      "orig_mod_len": 122480,
      "digsig_result": "Unsigned",
      "is_executable_image": false,
      "is_64bit": true,
      "facet_id": 708717,
      "endpoint": [
        "int-7535|5"
      ],
      "group": [
        "int_7535"
      ],
      "os_type": "Linux",
      "cb_version": 780,
      "host_count": 1,
      "last_seen": "2024-10-17T10:30:04.587Z",
      "digsig_issuer": "DigiCert",
      "digsig_publisher": "Digi",
      "alliance_score_virustotal": 20,
      "watchlists": [
        {
          "wid": "5",
          "value": "2024-10-17T10:30:04.482Z"
        }
      ]
    }
  ],
  "facets": {},
  "highlights": [
    {
      "name": "PREPREPREA92ACA8CE49D71D26B5853D0442A7473POSTPOSTPOST",
      "ids": [
        "A92ACA8CE49D71D26B5853D0442A7473"
      ]
    }
  ],
  "elapsed": 0.01130533218383789,
  "start": 0,
  "total_results": 1,
  "terms": [
    "A92ACA8CE49D71D26B5853D0442A7473"
  ]
}

{
   "q": "f34217144e41c2a0ea56df7056f0b4d7 and (status:Unresolved)"
}

{
  "results": [
    {
      "unique_id": "665d5e3c-08e2-4d3e-b39e-332939235ba5",
      "created_time": "2024-10-17T13:20:05.650Z",
      "alert_type": "watchlist.hit.query.process",
      "status": "Unresolved",
      "sensor_criticality": 3.0,
      "feed_rating": 3.0,
      "ioc_confidence": 0.5,
      "report_score": 75,
      "os_type": "linux",
      "username": "root",
      "process_name": "php",
      "process_path": "/usr/local/bin/php",
      "modload_count": 0,
      "filemod_count": 5,
      "regmod_count": 0,
      "netconn_count": 4,
      "childproc_count": 10,
      "crossproc_count": 0,
      "fileless_scriptload_count": 0,
      "md5": "73A444BE513D5FB25D9A78F2C8B5A9CB",
      "sha256": "(unknown)",
      "process_unique_id": "00000005-001d-8bc0-01db-207fa9066037-01929a084d71",
      "feed_name": "My Watchlists",
      "feed_id": -1,
      "watchlist_name": "PHP",
      "watchlist_id": "10",
      "ioc_type": "query",
      "ioc_attr": "{\"highlights\":[\"/usr/local/binPREPREPRE/phPOSTPOSTPOSTp\",\"PREPREPREphpPOSTPOSTPOST /var/www/api/artisan.php threatq:delete-cascade\",\"PREPREPREphpPOSTPOSTPOST\"]}",
      "process_id": "00000005-001d-8bc0-01db-207fa9066037",
      "segment_id": 1729161088369,
      "hostname": "int-7535",
      "group": "int_7535",
      "sensor_id": 5,
      "comms_ip": "10.113.2.226",
      "interface_ip": "10.113.2.226",
      "alert_severity": 50.625,
      "_version_": 1813167426300280832,
      "total_hosts": 1
    }
  ],
  "facets": {},
  "filtered": {},
  "highlights": [],
  "elapsed": 0.011178016662597656,
  "start": 0,
  "total_results": 1,
  "terms": [
    "int-7535",
    "73A444BE513D5FB25D9A78F2C8B5A9CB"
  ],
  "all_segments": true,
  "comprehensive_search": true,
  "incomplete_results": false
}

{
   "md5hash": "f41d8cd98f00b214e9800998ecf8427a",
   "text": "Exported from ThreatQ"
}

{
   "result": "success"
}

{
   "ipaddr": [
     "10.10.10.1"
   ]
}

Change Log

• Version 1.1.0
  • Added two new actions:
    • VMware Carbon Black EDR On Premise - Manage Banned Hashes.
    • VMware Carbon Black EDR On Premise - Manage Approved IP Addresses.
• Version 1.0.0
  • Initial release