How to Export and Review Carbon Black Cloud Logs
Summary
A guide to exporting Carbon Black Cloud process data through the Platform Search API or Data Forwarder, then filtering and reviewing the JSON logs. It covers API setup, retention limits, common errors, and how Carbon Black EDR differs.
Key points
- For targeted process-data exports, create a search job with the Platform Search API, wait for all backends to respond, then retrieve the results as JSON.
- Bulk or continuous exports can use the Data Forwarder to send endpoint events, alerts, and watchlist hits to an owned S3 bucket as compressed JSON.
- API access requires an API key with process-search permission, the organization key, and the correct Carbon Black Cloud environment hostname.
- Process-data retention depends on the subscription; the Data Forwarder can preserve data for longer-term use.
- Carbon Black EDR is an on-premises product with a different API from Carbon Black Cloud.
- The guide suggests uploading exported logs to LogTotal for review and lists fixes for authentication, permissions, incomplete results, hostname, and retention issues.
Article Details
- Topic
- Exporting Carbon Black Cloud and Carbon Black EDR logs for investigation