{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"4a7c0f57-709b-42c4-a35e-d1ca7cba1005"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"41a666ef-948a-4740-aac1-539daf603730"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"VMware Carbon Black","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.vmware.com/products/carbon-black-cloud-endpoint.html"}}]},{"text":" is a cloud-native endpoint, workload, and container protection platform that combines the intelligent system hardening and behavioral prevention needed to keep emerging threats at bay, using a single, easy-to-use console. By analyzing more than 1 trillion security events per day, VMware CBC proactively uncovers attackers’ behavior patterns and empowers defenders to detect and stop emerging attacks. ","type":"text"}]},{"type":"paragraph","content":[{"text":"This Devo collector helps to extend CBC's rich analytics and response actions to the rest of our customers' security stack.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Devo Collector features","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"4831b7a6-0757-4879-8a61-a2140dca3cd0"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Feature","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Allow parallel downloading (","type":"text"},{"text":"multipod","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Not allowed","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Running Environments","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Collector Server","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On Premise","type":"text","marks":[{"type":"code"}]}]}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"API Limits, Delays, Known Issues","type":"text"}]},{"type":"paragraph","content":[{"text":"With the credentials used, an intermittent 401(Principal is not authenticated) issue was being seen in the setup logs. This, however, gets resolved on its own and the puller recovers after some retries. ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data source description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"7cc96610-9843-406f-b410-c9f6c0f5641b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Data source","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[153.0]},"content":[{"type":"paragraph","content":[{"text":"Table","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[165.0]},"content":[{"type":"paragraph","content":[{"text":"Collector service","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"Remote endpoint","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[153.0]},"content":[{"type":"paragraph","content":[{"text":"endpoint.vmware.cbc_api.alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[165.0]},"content":[{"type":"paragraph","content":[{"text":"event_alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"https://defense.conferdeploy.net/api/alerts/v7/orgs/{org_key}/alerts/_search","type":"text","marks":[{"type":"underline"},{"type":"link","attrs":{"href":"https://defense.conferdeploy.net/api/alerts/v7/orgs/org_key/alerts/_search"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts Data Source indicates suspicious behavior and known threats in your environment.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Audit Logs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[153.0]},"content":[{"type":"paragraph","content":[{"text":"endpoint.vmware.cbc_defender.audit_logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[165.0]},"content":[{"type":"paragraph","content":[{"text":"event_audit_logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"https://defense.conferdeploy.net/integrationServices/v3/auditlogs","type":"text","marks":[{"type":"link","attrs":{"href":"https://defense.conferdeploy.net/integrationServices/v3/auditlogs"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"Audit Logs returns audit events in a system, such as when a user signs-in or updates a policy","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"Live Query","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[153.0]},"content":[{"type":"paragraph","content":[{"text":"endpoint.vmware.cbc_liveops.live_query","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[165.0]},"content":[{"type":"paragraph","content":[{"text":"event_live_query","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[134.0]},"content":[{"type":"paragraph","content":[{"text":"https://defense.conferdeploy.net//livequery/v1/orgs/{org_key}/runs","type":"text","marks":[{"type":"link","attrs":{"href":"https://defense.conferdeploy.net//livequery/v1/orgs/%7Borg_key%7D/runs"}}]},{"text":"/","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"Live Query allows users to send custom OSquery based SQL queries to get specific performance and security data","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Vendor setup","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to configure the Devo - VMware Carbon Black Cloud collector, you need to create API credentials that will be used to authenticate API requests.","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"0db1a5d3-cd60-4ea5-94c1-67a4eb1984b9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Required setup actions by collector services","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"text":"event_alerts","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"event_audit_logs","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[163.0]},"content":[{"type":"paragraph","content":[{"text":"event_live_query","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Open your API Access console","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[163.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Create a new ","type":"text"},{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[163.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Create a new ","type":"text"},{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[162.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[163.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Open your API Access console","type":"text"}]},{"type":"paragraph","content":[{"text":"VMware Carbon Black API Access console allows you to create, remove and edit your API credentials.","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"5d1389e0-bdc5-48e2-bca4-e0f8628bf5d5"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step-container.png"}}],"title":"Refined Step Container"}},"localId":"d2a924b2-16b6-4819-b0c3-78045b2298f9"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"98620f8d-fcf5-48f0-95b8-14d695198461"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"6442f176-5d92-498e-b406-eec92ecbd37e"}},{"type":"paragraph","content":[{"text":"Log in to your Carbon Black Cloud console.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1600,"id":"911e6718-0a04-43cb-a549-b7b512904e16","collection":"contentId-94657410","type":"file","height":562}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"73e31b7c-bcb4-4988-b885-001dd4d79390"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"d45f8b81-e2ea-4b57-9c1d-129f781eab1d"}},{"type":"paragraph","content":[{"text":"Now navigate to ","type":"text"},{"text":"Settings","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"→ API Access","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":3199,"id":"b4727047-e61b-4631-b2b0-d0e74fe8c6a8","collection":"contentId-94657410","type":"file","height":1353}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"8acfbc79-80e2-43de-a3d4-f758a40b4c71"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"890ec7fe-89e0-470e-94bc-6ac7bfd2fe2b"}},{"type":"paragraph","content":[{"text":"Note down your ","type":"text"},{"text":"Org Key","type":"text","marks":[{"type":"strong"}]},{"text":", which is displayed at the top left of the console.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":3191,"id":"12e5b593-df13-4c4b-ba28-3fee6c25aaf6","collection":"contentId-94657410","type":"file","height":1342}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a new ","type":"text"},{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"This token is required to run the ","type":"text"},{"text":"event_audit_logs","type":"text","marks":[{"type":"code"}]},{"text":" service and retrieve the ","type":"text"},{"text":"Audit Logs","type":"text","marks":[{"type":"strong"}]},{"text":" data source.","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"db891c5e-1dcd-4a0b-9c10-28e7bf671935"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step-container.png"}}],"title":"Refined Step Container"}},"localId":"1fdb92a6-ca0c-49e3-ba3d-15172c980957"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"963551fd-9987-40f7-84ba-badfda4f40dc"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"64e371d5-8898-4643-8e3c-77c32e9cc60c"}},{"type":"paragraph","content":[{"text":"On the top right, click ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" to open the creation screen. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":95.0},"content":[{"type":"media","attrs":{"width":3191,"id":"6859f1d6-7eea-4856-912a-c89cab8a4848","collection":"contentId-94657410","type":"file","height":1342}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"0208196a-9a98-45f1-8096-65124262d630"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"eb67e458-85df-453f-bb92-a09e5d19e85a"}},{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" creation form:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"a499f062-0356-475e-a2a1-5a7f21b3cf51"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[211.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[515.0]},"content":[{"type":"paragraph","content":[{"text":"Type in a unique name for your API key.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[211.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[515.0]},"content":[{"type":"paragraph","content":[{"text":"Enter an optional detailed description of the purpose of the credentials.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[211.0]},"content":[{"type":"paragraph","content":[{"text":"Access level type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[515.0]},"content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"API","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[211.0]},"content":[{"type":"paragraph","content":[{"text":"Authorized IP address","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[515.0]},"content":[{"type":"paragraph","content":[{"text":"Enter an optional list of authorized IP addresses that this API key can use.","type":"text"}]}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":90.0},"content":[{"type":"media","attrs":{"width":3194,"id":"7a333fd9-45cb-400f-9e3d-77787abb5885","collection":"contentId-94657410","type":"file","height":1351}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"54996890-e11e-44d7-adde-77f031329124"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"8b269237-3afe-46f6-981b-8dfedd84440c"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". You will be prompted with a window displaying your API credentials (API ID and API Secret Key). Note them down.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":95.0},"content":[{"type":"media","attrs":{"width":3197,"id":"447706b3-2e1b-4c90-8ff2-12ad9308430c","collection":"contentId-94657410","type":"file","height":1358}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"40184882-505d-460a-a837-3ca5fbcdae0a"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"2609c801-452f-431c-b5a8-ffb92825c079"}},{"type":"paragraph","content":[{"text":"Finally, generate the final token by mixing your ","type":"text"},{"text":"API secret","type":"text","marks":[{"type":"code"}]},{"text":" key + “/” + ","type":"text"},{"text":"API ID","type":"text","marks":[{"type":"code"}]},{"text":" as follows:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Secret Key","type":"text","marks":[{"type":"strong"}]},{"text":" →","type":"text"},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"012345","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API ID","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"The final audit token would be → ","type":"text"},{"text":"012345/ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a new ","type":"text"},{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"This token is required to run the ","type":"text"},{"text":"event_alert","type":"text","marks":[{"type":"code"}]},{"text":" service and retrieve the ","type":"text"},{"text":"Alert","type":"text","marks":[{"type":"strong"}]},{"text":" data source.","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"710138c9-06dc-447a-a801-5640e08a0e75"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step-container.png"}}],"title":"Refined Step Container"}},"localId":"00997b26-539a-4929-986b-62970e8c9757"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"8ef9e144-4290-476d-bb5e-6e2b17968473"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"1e63af90-377f-43cf-922a-b30e1387f1aa"}},{"type":"paragraph","content":[{"text":"Generic tokens require an associated ","type":"text"},{"text":"Access Level","type":"text","marks":[{"type":"strong"}]},{"text":". On the top left, click the ","type":"text"},{"text":"Access Levels","type":"text","marks":[{"type":"strong"}]},{"text":" tab.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"6cbfea69-252e-43c2-a142-ed315080f98d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"8f3e6684-8373-4660-b7e6-8e17dbf4f95e"}},{"type":"paragraph","content":[{"text":"On the top right, click on ","type":"text"},{"text":"Add Access Level ","type":"text","marks":[{"type":"strong"}]},{"text":"to open the creation screen.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":90.0},"content":[{"type":"media","attrs":{"width":3196,"id":"f0ba7c5a-6e6a-4c78-9531-cb007189fe2a","collection":"contentId-94657410","type":"file","height":1356}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"a2ce8d90-f296-49fb-af73-b93df4c5c571"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"9a530db1-8c23-4b53-a3ba-0a5534e7823b"}},{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add Access Level","type":"text","marks":[{"type":"strong"}]},{"text":" creation form.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"7ee0d41e-f806-4cc1-bf3b-f05d0cdb192b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[237.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Type in a unique name for your API key.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[237.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Type in a detailed description of the purpose of the credentials.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[237.0]},"content":[{"type":"paragraph","content":[{"text":"Required permissions","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Add the following permission levels to enable the ","type":"text"},{"text":"event_alert","type":"text","marks":[{"type":"code"}]},{"text":" service:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.retention","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.alerts.notes","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.alerts","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"device","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"Add the following permission levels to enable the ","type":"text"},{"text":"event_live_query","type":"text","marks":[{"type":"code"}]},{"text":" service:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Live Query","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Create Read Update Delete Execute","type":"text","marks":[{"type":"code"}]}]}]}]}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":90.0},"content":[{"type":"media","attrs":{"width":3199,"id":"96c9f4f8-d909-4cfd-8d04-2b8a169fac54","collection":"contentId-94657410","type":"file","height":1388}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"4f74c3b6-efe4-4c4e-9d43-7910face89d0"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"e699bc7e-ceb4-45c5-8d54-2e3fbb2ed81f"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". Now, go to the ","type":"text"},{"text":"API Keys","type":"text","marks":[{"type":"strong"}]},{"text":" tab and click ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" at the top right area.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"f595b5a8-04cc-4e0d-a2fd-2b6ebe8aaaed"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"cdcc6d30-a52e-48b0-8466-b2c5c989be89"}},{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" creation form:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"59746d7b-2b08-46f4-b0d2-c72d39cb0968"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[492.0]},"content":[{"type":"paragraph","content":[{"text":"Type in a unique name for your API key.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[492.0]},"content":[{"type":"paragraph","content":[{"text":"Enter an optional detailed description of the purpose of the credentials.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"Access level type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[492.0]},"content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Custom","type":"text","marks":[{"type":"code"}]},{"text":". In the ","type":"text"},{"text":"Custom Access Level ","type":"text","marks":[{"type":"strong"}]},{"text":"dropdown that appears, choose the ","type":"text"},{"text":"Access Level","type":"text","marks":[{"type":"strong"}]},{"text":" role defined ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"Authorized IP address","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[492.0]},"content":[{"type":"paragraph","content":[{"text":"Enter an optional list of authorized IP addresses that this API key can use.","type":"text"}]}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":90.0},"content":[{"type":"media","attrs":{"width":3194,"id":"f02ee378-54e2-4941-baaf-1e17e4bdbc85","collection":"contentId-94657410","type":"file","height":1351}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"feaf05f1-209a-461f-9a9c-6f2b685986d8"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"cdfbb4ac-4040-4251-917f-28b08be6e71c"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". You will be prompted with a window displaying your API credentials (API ID and API Secret Key). Note them down.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"42ae1277-1b4c-4c86-ab7c-4994dcee7dd0"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"6edbb7bc-59d9-4aaf-a06c-b7d95c1ac8aa"}},{"type":"paragraph","content":[{"text":"Finally, generate the final token by mixing your ","type":"text"},{"text":"API secret","type":"text","marks":[{"type":"code"}]},{"text":" key + “/” + ","type":"text"},{"text":"API ID","type":"text","marks":[{"type":"code"}]},{"text":" as follows:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Secret Key","type":"text","marks":[{"type":"strong"}]},{"text":" →","type":"text"},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"012345","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API ID","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"The final audit token would be → ","type":"text"},{"text":"012345/ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"wide","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"51c8f0ae-a00f-4ec9-807a-3e1bc4f90ea5"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"f237ecea-4668-479f-ba8e-87b28d14a0e3"},"content":[{"type":"extension","attrs":{"layout":"wide","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"31c1ff92-e916-4b98-af29-6195e62d79c1"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"bd0f65e2-8ebe-440d-a140-702f4630ea77"}},{"type":"paragraph","content":[{"text":"We use a piece of software called Collector Server to host and manage all our available collectors.","type":"text"}]},{"type":"paragraph","content":[{"text":"To enable the collector for a customer:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Server","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"GUI","type":"text","marks":[{"type":"strong"}]},{"text":", access the ","type":"text"},{"text":"domain","type":"text","marks":[{"type":"strong"}]},{"text":" in which you want this instance to be created","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Add Collector","type":"text","marks":[{"type":"strong"}]},{"text":" and find ","type":"text"},{"text":"MVware Carbon Black Cloud - Integrations Factory","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Version","type":"text","marks":[{"type":"strong"}]},{"text":" field, select the latest value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Collector Name","type":"text","marks":[{"type":"strong"}]},{"text":" field, set the value you prefer (this name must be unique inside the same Collector Server domain).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the sending method select ","type":"text"},{"text":"Direct Send. Direct Send","type":"text","marks":[{"type":"strong"}]},{"text":" configuration is optional for collectors that create ","type":"text"},{"text":"Table","type":"text","marks":[{"type":"code"}]},{"text":" events, but mandatory for those that create ","type":"text"},{"text":"Lookups","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" section, establish the ","type":"text"},{"text":"Collector Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" as follows below:","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the JSON configuration","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"inputs\":{\n \"carbonblackcloud\":{\n \"id\": ,\n \"enabled\": ,\n \"requests_per_second\": ,\n \"override_base_url\": \"\",\n \"credentials\": {\n \"generic_token\": \"\",\n \"audit_token\": \"\",\n \"org_key\": \"\"\n },\n \"services\":{\n \"event_alerts\":{\n \"request_period_in_seconds\": ,\n \"initial_start_time_in_utc\": \"\"\n },\n \"event_audit_logs\":{\n \"request_period_in_seconds\": \n },\n \"event_live_query\":{\n \"initial_start_time_in_utc\": \"\",\n \"request_period_in_seconds\": ,\n \"query_name\": \"\",\n \"query\": \"\",\n \"query_id\": \"\",\n \"soft_timeout_seconds\": ,\n \"hard_timeout_seconds\": ,\n \"minimum_percent\": ,\n \"device_filter\": \n }\n }\n }\n }\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the ","type":"text"},{"text":"services","type":"text","marks":[{"type":"code"}]},{"text":" object.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Please replace the placeholders with real world values following the description table below:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"8cf558f7-be37-4075-a0e5-2ea3d3df3446"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Value range / Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"input_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give an unique id to this input service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"input_status","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"false / true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"If the value is true, the input definition will be executed. If the value is false, the service will be ignored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"requests_per_second","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum value: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Customize the maximum number of API requests per second. If not used, the default setting will be used: ","type":"text"},{"text":"100000","type":"text","marks":[{"type":"code"}]},{"text":" requests/sec.","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"override_base_url","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Valid URL","type":"text"}]},{"type":"paragraph","content":[{"text":"Regex: ","type":"text"},{"text":"(\"((http|https)://)(www.)?\" + \"[a-zA-Z0-9@:%._\\\\+~#?&//=]\" + \"{2,256}\\\\.[a-z]\" + \"{2,6}\\\\b([-a-zA-Z0-9@:%\" + \"._\\\\+~#?&//=]*)\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Set a custom value to override the default URL ","type":"text"},{"text":"https://defense.conferdeploy.net","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Required when running ","type":"text"},{"text":"event_alerts","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"event_live_query_service","type":"text","marks":[{"type":"code"}]},{"text":" service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Required when running ","type":"text"},{"text":"event_audit_logs","type":"text","marks":[{"type":"code"}]},{"text":" service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"org_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"This is your Carbon Black Cloud ","type":"text"},{"text":"Org Key","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Period in seconds used between each data pulling, this value will overwrite the default value (300 seconds)","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"start","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Format expected: ","type":"text"},{"text":"YYYY-MM-DD HH:MM:SS","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter used by the collector as the starting ","type":"text"},{"text":"UTC","type":"text","marks":[{"type":"code"}]},{"text":" point when it first pulls data. (Required for event_live_query and event_alerts services)","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Updating this value will produce the lost of all persisted data and current pipelines.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"query_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Name to identify the query in the Carbon Black Cloud platform.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"query_in_sql","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Valid SQL query","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Query that will be executed must be written in SQL format.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"query_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"ID as provided by Osquery","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"If the user already has a started query from which it wants to extract data from they can write the ID of said query here.","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"soft_timeout_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Practical value: between 60 and 300 seconds","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Time that the program will wait before reaching minimum percent of completion.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"hard_timeout_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Practical value: between 120 and 400 seconds","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Maximum time that collector will wait before sending queries data to Devo.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"minimum_percent","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Example value: 40 or 50, meaning 40% or 50%","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum percentage of completion that the query needs in order to activate the sending data to Devo.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[222.0]},"content":[{"type":"paragraph","content":[{"text":"device_filter","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"object","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"contains criteria to filter devices by, for example: a list of OS types like “LINUX”, “WINDOWS”","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Provides the option to run the query on certain devices which match with the criteria defined in it.","type":"text"}]}]}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"4baf4f40-4f47-40ff-aafb-dc8cad47e70b"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"c9c20760-fd71-4444-bfcc-fb6f0fdb40f5"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"structure"},"legacyAnchorId":{"value":"VMwareCarbonBlackCloudcollector-structure"}},"macroMetadata":{"macroId":{"value":"7a96c7e1-cc3b-4732-ac2b-e620a0fe6a0e"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"714603de-25f0-447a-b4da-ef77c060f230"}},{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for being used when running the collector:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── /\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n ├── state/\n └── config/ \n └── config.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"devocredentials"},"legacyAnchorId":{"value":"VMwareCarbonBlackCloudcollector-devocredentials"}},"macroMetadata":{"macroId":{"value":"eab6b2be-aa15-4d29-82a6-73a759cd1447"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"df10cfe0-ae1a-43fa-9371-bf615c918124"}},{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text"},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text"},{"text":"devo-collector-vmware-/certs/","type":"text","marks":[{"type":"code"}]},{"text":". Learn more about security credentials in Devo ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763701"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":950,"id":"935aa67a-eb60-49c8-81fb-726b86236a5e","collection":"contentId-94657410","type":"file","height":448}}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"awscredentials"},"legacyAnchorId":{"value":"VMwareCarbonBlackCloudcollector-awscredentials"}},"macroMetadata":{"macroId":{"value":"907b08d6-6330-4bd7-8a6f-7547aaa994ac"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"110d1257-a94c-44ea-8ed7-166bde89d3ab"}},{"text":"Editing the config.yaml file","type":"text"}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: true\n id: \n name: \n persistence:\n type: filesystem\n config:\n directory_name: state\n multiprocessing: \n\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: \n port: 443\n type: SSL\n chain: \n cert: \n key: \ninputs:\n carbonblackcloud:\n id: \n enabled: \n requests_per_second: \n override_base_url: \n credentials:\n generic_token: \n audit_token: \n org_key: \n services:\n event_alerts:\n request_period_in_seconds: \n initial_start_time_in_utc: \n event_audit_logs:\n request_period_in_seconds: \n event_live_query:\n initial_start_time_in_utc: \n request_period_in_seconds: \n query_name: \n query: \n query_id: \n soft_timeout_seconds: \n hard_timeout_seconds: \n minimum_percent: \n device_filter: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the placeholders with your required values:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"b173b126-5fca-42a5-a453-7cec31ead10e"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Value range","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"collector_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give an unique id to this collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"collector_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 10","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a valid name to this collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"multiprocessing_mode","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"false / true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"If the value is true, the collector will run using a multiprocessing architecture. If the value is false, the collector will use only one CPU.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"devo_address","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"collector-us.devo.io","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"collector-eu.devo.io","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the Devo Cloud where the events will be sent.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"chain_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 4","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: ","type":"text"},{"text":"chain.crt","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"cert_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 4","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the ","type":"text"},{"text":"file.cert","type":"text","marks":[{"type":"code"}]},{"text":" downloaded from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"key_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 4","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the ","type":"text"},{"text":"file.key","type":"text","marks":[{"type":"code"}]},{"text":" downloaded from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"input_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"},{"type":"hardBreak"},{"text":"Maximum length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give an unique id to this input service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"input_status","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"false / true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"If the value is true, the input definition will be executed. If the value is false, the service will be ignored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"requests_per_second","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum value: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Customize the maximum number of API requests per second. If not used, the default setting will be used: ","type":"text"},{"text":"100000","type":"text","marks":[{"type":"code"}]},{"text":" requests/sec.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"override_base_url","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Valid URL","type":"text"}]},{"type":"paragraph","content":[{"text":"Regex: ","type":"text"},{"text":"(\"((http|https)://)(www.)?\" + \"[a-zA-Z0-9@:%._\\\\+~#?&//=]\" + \"{2,256}\\\\.[a-z]\" + \"{2,6}\\\\b([-a-zA-Z0-9@:%\" + \"._\\\\+~#?&//=]*)\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Set a custom value to override the default URL ","type":"text"},{"text":"https://defense.conferdeploy.net","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Required when running ","type":"text"},{"text":"event_alerts","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"event_live_query_service","type":"text","marks":[{"type":"code"}]},{"text":" service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Required when running ","type":"text"},{"text":"event_audit_logs","type":"text","marks":[{"type":"code"}]},{"text":" service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"org_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"This is your Carbon Black Cloud ","type":"text"},{"text":"Org Key","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Period in seconds used between each data pulling, this value will overwrite the default value (300 seconds)","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"start","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Format expected: ","type":"text"},{"text":"YYYY-MM-DD HH:MM:SS","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter used by the collector as the starting ","type":"text"},{"text":"UTC","type":"text","marks":[{"type":"code"}]},{"text":" point when it first pulls data. (Required for event_live_query and event_alerts services)","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Updating this value will produce the lost of all persisted data and current pipelines.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"query_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: Test_query","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Name to identify the query in the Carbon Black Cloud platform.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"query_in_sql","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Valid SQL query","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: ","type":"text"},{"text":"SELECT * FROM carbon_black_info;","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Query that will be executed must be written in SQL format.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"query_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"ID as provided by Osquery","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"If the user already has a started query from which it wants to extract data from they can write the ID of said query here.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"soft_timeout_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Practical value: between 60 and 300 seconds","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Time that the program will wait before reaching minimum percent of completion.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"hard_timeout_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Practical value: between 120 and 400 seconds","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Maximum time that collector will wait before sending queries data to Devo.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"minimum_percent","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: 1","type":"text"}]},{"type":"paragraph","content":[{"text":"Example value: 40 or 50, meaning 40% or 50%","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum percentage of completion that the query needs in order to activate the sending data to Devo.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"device_filter","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[132.0]},"content":[{"type":"paragraph","content":[{"text":"object","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[201.0]},"content":[{"type":"paragraph","content":[{"text":"contains criteria to filter devices by, for example: a list of OS types like “LINUX”, “WINDOWS”","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Provides the option to run the query on certain devices which match with the criteria defined in it.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"c0377ca8-b948-47ce-97e5-7af7ee38442a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[495.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[482.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[495.0]},"content":[{"type":"paragraph","content":[{"text":"collector-vmware-carbonblackcloud-docker-image-1.5.0.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1QRF8SyCZKohCO7vx8rUz1y2y4ClNHDOJ/view?usp=drive_link"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[482.0]},"content":[{"type":"paragraph","content":[{"text":"8f78421821f911aaf7e7ccb987b59f495a3f199f977dba9b71c9ee07260b62e4","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"codeBlock","content":[{"text":"gunzip -c collector-vmware-carbonblackcloud-docker-image-.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace \"","type":"text","marks":[{"type":"textColor","attrs":{"color":"#5c5c5c"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"\" with a proper value","type":"text","marks":[{"type":"textColor","attrs":{"color":"#5c5c5c"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"docker"},"legacyAnchorId":{"value":"VMwareCarbonBlackCloudcollector-docker"}},"macroMetadata":{"macroId":{"value":"bacfce02-0eb5-4c55-ba06-0000bdd5924c"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"3fffa426-96ed-4375-9e25-6cf159dd68c1"}},{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \n--name collector- \n--volume $PWD/certs:/devo-collector/certs \n--volume $PWD/config:/devo-collector/config \n--volume $PWD/state:/devo-collector/state \n--env CONFIG_FILE=config.yaml \n--rm \n--interactive \n--tty \n:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"product_name>","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required values.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"dockercompose"},"legacyAnchorId":{"value":"VMwareCarbonBlackCloudcollector-dockercompose"}},"macroMetadata":{"macroId":{"value":"9f9f777d-3e59-4d3a-92b3-a185ce02a151"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"12a6e7c7-503e-4d2c-8cb2-789c15775058"}},{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-:\n image: :${IMAGE_VERSION:-latest}\n container_name: collector-\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./credentials:/devo-collector/credentials\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"product_name>","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required values.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"API limitations","type":"text"}]},{"type":"paragraph","content":[{"text":"Rate limiting is currently not enforced. However, excessive usage is monitored. Excessive usage can result in temporary enforcement of rate-limiting.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Change log","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"db4a3660-e2e2-4762-998a-644f587aad61"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"Release","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"Released on","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"text":"Release type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Recommendations","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"v1.5.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"type":"date","attrs":{"timestamp":"1732752000000"}},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"improvements","localId":"4ae86817-2f83-431f-87e5-52d30269b91d"}},{"type":"hardBreak"},{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"960c66ce-0b4f-47c8-82af-fcca37249fee"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Recommended version","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[191.0,192.0,240.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated the docker base image to 1.3.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update DCSDK from 1.12.4 to 1.12.4:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed internal queue management for protecting against OOMK","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracted ModuleThread structure from PullerAbstract","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved Controlled stop when both processes fails to instantiate","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved Controlled stop when InputProcess is killed","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed error related a ValueError exception not well controlled","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refactored code for the livequery, alerts and audit service in accordance with template1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Eliminated the use of while loops in the pull logic","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added Unit Tests for the livequery, alerts and audit services","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Bug fixing","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"fixed the 400 API error received the when collector was invoking the carbon black live query API","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"v1.4.2","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1723680000000"}},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"improvements","localId":"b2cf29d2-7efe-4d9b-b09b-5954a00f4a78"}},{"type":"hardBreak"},{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"53d6a8b2-b812-40d2-a351-caf0d234ff77"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[191.0,192.0,240.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated the docker base image to 1.3.0","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update DCSDK from 1.11.1 to 1.12.4:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added new sender for relay in house + TLS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added persistence functionality for gzip sending buffer","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added Automatic activation of gzip sending","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved behaviour when persistence fails","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgraded DevoSDK dependency","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed console log encoding","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restructured python classes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improved behaviour with non-utf8 characters","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Decreased defaut size value for internal queues (Redis limitation, from 1GiB to 256MiB)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New persistence format/structure (compression in some cases)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Removed dmesg execution (It was invalid for docker execution)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Applied changes to make DCSDK compatible with MacOS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgrade DevoSDK dependency to version v5.4.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change internal queue management for protecting against OOMK","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracted ModuleThread structure from PullerAbstract","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improve Controlled stop when both processes fails to instantiate","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improve Controlled stop when InputProcess is killed","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bug related to lost of collector_name , collector_id and job_id","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bug retaled queues and ValueError","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Bug fixing","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed remove duplicate logic.","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"v1.4.1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1688515200000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"improvements","localId":"a249f6a3-dde1-4b27-bbc3-48816a8a8f51"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[191.0,192.0,240.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated ","type":"text"},{"text":"DevoCollectorSDK","type":"text","marks":[{"type":"code"}]},{"text":" from 'v1.7.2' to ","type":"text"},{"text":"v1.11.1","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensure special characters are properly sent to the platform","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed log level to some messages from info to debug","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed some wrong log messages","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgraded some internal dependencies","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changed queue passed to setup instance constructor","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ability to validate collector setup and exit without pulling any data","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ability to store in the persistence the messages that couldn't be sent after the collector stopped","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ability to send messages from the persistence when the collector starts and before the puller begins working","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DevoSDK to v5.1.9","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed some bug related to development on MacOS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added an extra validation and fix when the DCSDK receives a wrong timestamp format","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added an optional config property for use the Syslog timestamp format in a strict way","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DevoSDK to v5.1.10","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fix for SyslogSender related to UTF-8","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enhance of troubleshooting. Trace Standardization, Some traces has been introduced.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Introduced a mechanism to detect \"Out of Memory killer\" situation","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"upgraded dcsdk-docker-base-image to 1.2.0","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"migrate to alerts v7 endpoint","type":"text"}]}]}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"v1.3.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1680652800000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"improvements","localId":"bbf8308c-7d31-465f-b02d-e5c2bded5035"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[191.0,192.0,240.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upgrade SDK from version 1.1.4 to 1.7.2.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changes in logging.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refactor some code.","type":"text"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":2,"colwidth":[137.0]},"content":[{"type":"paragraph","content":[{"text":"v1.2.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1659657600000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[192.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"purple","style":"bold","text":"INITIAL RELEASE","localId":"2db9aab6-3ff8-4879-8eb7-4951307cb1c8"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[240.0]},"content":[{"type":"paragraph","content":[{"text":"Initial version","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[191.0,192.0,240.0]},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"New features","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"CBC Live Queries. An advanced user can define a custom query for pulling data about performance and security that Osquery makes available. The query can be expressed using the SQL language featured by Osquery.","type":"text"}]}]}]}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported