Is the carbon black TA and eventforwarder required for this app?

[jgoddard]

It isn't completely clear from the readme how this app fits with the cb-event-forwarder https://github.com/carbonblack/cb-event-forwarder and the Carbon Black TA (https://splunkbase.splunk.com/app/2790/).

Do I still need to have the TA connect to the event forwarder, or does the new app leverage the search heads to directly query the carbon black server via API (which is how it sounds).

Thanks.

[jgoddard]

Thank you for the prompt response. I understand how the TA and the event-forwarder on carbon black interact. On the other hand, the new Carbon Black Integration app (https://splunkbase.splunk.com/app/3099/#/documentation) seems to indicate that the only requirement is using your Carbon Black API key:
To setup the Splunk App:

Navigate to the Apps Manager page.
Look for the Carbon Black Enterprise Response App
Click 'Set up'
Enter your server URL in the 'CB server URL' text box. (example: https://cbserver.mycompany.com)
Paste the Carbon Black API Token into the text box labelled 'API Key'.
Click 'Save'

So, my question is does the new splunk app need the apikey functionality, the cb-event-forwarder JSON converter, AND the carbon black TA, or is it able to do all data collection via the API, or are they completely separate?

Thanks.

[shaskell_splunk]

That app appears to only need an API key so you won't need the other components. Note that the app is in beta.

[shaskell_splunk]

The app docs state:

Note: This add-on consumes Carbon Black event data from a JSON file. In order to get the Carbon Black event data into JSON format, you must download and run a utility from Bit9.

This link states:

This add-on consumes Carbon Black event data from a JSON file. You need to download and run the Carbon Black Event Forwarder utility (cb-event-forwarder) in order to generate the JSON file. Splunk monitors the JSON file that is generated by the utility. The cb-event-forwarder utility and installation instructions are available from GitHub at https://github.com/carbonblack/cb-event-forwarder. An RPM package of the utility is available at https://opensource.carbonblack.com/release/x86_64/.

So you do need the Carbon Black event forwarder to generate the JSON and then the Splunk Carbon Black TA consumes that file.