Ingest Carbon Black Cloud Data into Cloud SIEM

To ingest Carbon Black Cloud data into Cloud SIEM:

1. Configure an AWS S3 source on a collector. When you configure the source, do the following:
   1. Click the +Add Field link, and add a field whose name is _siemForward and value is true. This will ensure all logs for this source are forwarded to Cloud SIEM.
   2. Click the +Add link to add a field whose name is _parser with value /Parsers/System/VMware/Carbon Black Cloud. This ensures that the Carbon Black Cloud logs are parsed and normalized into structured records in Cloud SIEM.
2. Configure Carbon Black Cloud to send log messages to the S3 bucket. For instructions, see Data Forwarders in the Carbon Black Cloud documentation.
3. To verify that your logs are successfully making it into Cloud SIEM:
   1. Classic UI. In the top menu select Configuration, and then under Incoming Data select Log Mappings.
      New UI. In the top menu select Configuration, and then under Cloud SIEM Integrations select Log Mappings. You can also click the Go To... menu at the top of the screen and select Log Mappings.
   2. On the Log Mappings tab search for Carbon Black Cloud and check the Records columns.
   3. For a more granular look at the incoming records, you can also search Sumo Logic for Carbon Black Cloud records:
      _index=sec_record* and metadata_product = "Carbon Black Cloud"