Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Carbon Black EDR Integration for NSX Defender (900003)

Last Updated: 1/21/2022Categories: How toTotal Views: 1360Language:
English

1 like this article

Subscribe to get an email
newsletter with new updates

1 people found this helpful Please provide article feedback:

Details

Carbon Black Endpoint Detection and Response (EDR) ships with support for threat intelligence feeds. You can add a feed from NSX Lastline Defender consisting of identified malicious domains and IP addresses that comprise Indicators of Compromise (IOCs). Any activity matching an IOC from the feed is tagged by the EDR. Carbon Black users can then search for the tags and, optionally, register for e-mail alerts.

Configure the NSX Lastline Defender Feed

To add a feed from NSX Lastline Defender, perform the following steps:

From the Carbon Black EDR console, click the Threat Intelligence link to load the Threat Intelligence Feeds tab.

Click the + Add New Feed button.

The Carbon Black EDR displays a form where you configure the parameters for the NSX Lastline Defender feed:

Click Add From URL tab.

Enter a URL in the Feed URL textbox. For example, https://user.lastline.com/papi/net/ioc_feed/network_ioc_feed_cb_edr

If required in your installation, click the Use Proxy check-box.

Provide your NSX Lastline user credentials in the Username and Password textboxes.

Click SAVE to save the NSX Lastline Defender feed.

On the Threat Intelligence Feeds tab, a new card appears:

By default, the NSXLastline Defender feed is disabled. Click the Enabled check-box to enable the feed.

View the NSX Lastline Defender Feed

Once the NSX Lastline Defender feed is enabled it doesn't take long for the IOCs imported from the NSX Lastline backend to appear. In the NSX Lastline card on the Threat Intelligence Feeds tab, click the Threat Reports » link. The Search Threat Reports tab is loaded with a list of all the IoCs acquired from the NSX Lastline feed. When you click on a specific row, you can view the details of the selected IoC.

Optional Parameters

Use the following optional parameters to modify the data returned by the feed from NSX Lastline Defender:

key — Restrict to appliances with this key (access_key).

key_id — Restrict to appliances with this access key ID.

max_age_days — Get IoCs that occurred at most this number of days ago. Cannot be specified together with since. By default, the API returns the IoCs of the last 30 days.

since — Get IoCs that occurred after this date. By default, the API returns the IoCs of the last 30 days.

min_impact — Get IoCs with an impact greater than the specified value.

max_results — Limit the response to the specified number of results. At most 100,000 results are returned.

The optional parameters are query strings appended to the URL provided in the Feed URL textbox. For example, if you only want IoCs from the last 7 days, use the max_age_days parameter and set it to 7:

https://user.lastline.com/papi/net/ioc_feed/network_ioc_feed_cb_edr?max_age_days=7

If you want IoCs from the previous 60 days, but restricted to 10 results, set max_age_days to 60 and max_results to 10:

https://user.lastline.com/papi/net/ioc_feed/network_ioc_feed_cb_edr?max_results=10&max_age_days=60

Refer to the attachments for more screenshots of the integration.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
夏時間によって、レポート スケジュールにおけるコンソールの次回実行日が変更される (84459)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX Detonator

VMware NSX Defender

Related Versions:

Take Our Survey

Support Assistant