Integrating with Broadcom Carbon Black Instructions to set up Amazon S3 and Amazon SQS Configuring the CloudWatch Pipeline Supported Open Cybersecurity Schema Framework Event Classes

Source configuration for Broadcom Carbon Black

Integrating with Broadcom Carbon Black

CloudWatch Pipeline ingests Broadcom Carbon Black event data from Amazon S3. You configure Carbon Black Cloud to export event data to an Amazon S3 bucket using the Data Forwarder, then create a pipeline that reads from that bucket using Amazon SQS notifications.

To integrate CloudWatch Pipelines with Broadcom Carbon Black, complete the following high-level steps:

Configure Carbon Black Cloud Data Forwarder to export events to an Amazon S3 bucket.
Set up Amazon SQS notifications on the Amazon S3 bucket for new object creation.
Create the required IAM role for pipeline access.
Create a CloudWatch pipeline with Broadcom Carbon Black as the data source.
Verify that data is flowing into the pipeline.

Instructions to set up Amazon S3 and Amazon SQS

Setting up the Carbon Black Data Forwarder to send logs to an Amazon S3 bucket involves several steps to create the required Amazon resources (Amazon S3 bucket, Amazon SQS queue, IAM roles) and configure the Carbon Black Data Forwarder to send the desired log events.

Create an Amazon S3 bucket to store Carbon Black logs.

Important
You must select the same region as your Broadcom Carbon Black instance. See the Carbon Black documentation on the Broadcom developer website to determine which Amazon region your Carbon Black product URL maps to.

Important
CloudWatch Pipelines will not be able to apply OCSF transformations or other processing to KMS encrypted logs. If processing is needed, do not set up KMS encryption.

For detailed instructions, see Configure the Destination: Use Amazon S3 in the Carbon Black Data Forwarder documentation on the Broadcom developer website.
Attach an IAM policy to the Amazon S3 bucket to grant the Forwarder permissions to write to your bucket (see Example IAM policy for Amazon S3 bucket below).

Note
The Principal ID ARN to use in the policy is based on the Amazon region the Amazon S3 bucket is in. See the Principal ID to allow by Amazon Region table below.
Create an Amazon SQS queue in the same Amazon region as your Amazon S3 bucket. This queue will receive notifications when new log files are added to the Amazon S3 bucket. For more information, see Create an Amazon SQS queue.
Attach an IAM policy to the Amazon SQS queue to allow Amazon S3 to write event notifications to the Amazon SQS queue (see Example IAM policy for Amazon SQS queue below).
Configure the Amazon S3 bucket to generate "Object Create" event notifications to be sent to the Amazon SQS queue. For more information, see Enable event notifications on the S3 bucket with the SQS queue as a destination.
Create and configure the Carbon Black Data Forwarder, through the Carbon Black Console or API, by following the Carbon Black Create a Forwarder documentation. For complete documentation, see Carbon Black Data Forwarders on the Broadcom website.

Example IAM policy for Amazon S3 bucket


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCarbonBlackForwarderWriteAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::132308400445:role/mcs-psc-prod-event-forwarder-<aws-region>-event-forwarder"
            },
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::<bucket-name>[/<prefix>]/*"
        }
    ]
}

Principal ID to allow by Amazon Region

Amazon Region	Principal ID
US East (N. Virginia) us-east-1	`arn:aws:iam::132308400445:role/mcs-psc-prod-event-forwarder-us-east-1-event-forwarder`
Europe (Frankfurt) eu-central-1	`arn:aws:iam::132308400445:role/mcs-psc-prod-event-forwarder-eu-central-1-event-forwarder`
Asia Pacific (Tokyo) ap-northeast-1	`arn:aws:iam::132308400445:role/mcs-psc-prod-event-forwarder-ap-northeast-1-event-forwarder`
Asia Pacific (Sydney) ap-southeast-2	`arn:aws:iam::132308400445:role/mcs-psc-prod-event-forwarder-ap-southeast-2-event-forwarder`

Example IAM policy for Amazon SQS queue


{
    "Version": "2012-10-17",
    "Id": "PolicyForS3SendMessage",
    "Statement": [
        {
            "Sid": "AllowS3SendMessage",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "sqs:SendMessage",
            "Resource": "arn:aws:sqs:<aws-region>:<aws-account-number>:<queue-name>",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:::<bucket-name>"
                },
                "StringEquals": {
                    "aws:SourceAccount": "<aws-account-number>"
                }
            }
        }
    ]
}

Configuring the CloudWatch Pipeline

When configuring the pipeline to read data from Broadcom Carbon Black, choose Broadcom Carbon Black as the data source. After you create the pipeline, data will be available in the selected CloudWatch Logs log group. The log group will require a resource policy. The policy is automatically added if the pipeline is created through the console.

Supported Open Cybersecurity Schema Framework Event Classes

This integration supports OCSF schema version v1.5.0 and the Broadcom Carbon Black log events (Endpoint Events v1.2.0, Alerts v2.1.0, Watchlist Hits v1.0.0, Auth Events v1.0.0, Audit Logs v1.0.0) that map to the following OCSF event classes.

When parseOCSF is enabled, if any log events aren't one of the supported log event types, the logs will be ingested in their raw form with a @transformationError field added and a TransformationErrors metric emitted.