{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"4a7c0f57-709b-42c4-a35e-d1ca7cba1005"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"41a666ef-948a-4740-aac1-539daf603730"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Service description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"VMware Carbon Black","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.vmware.com/products/carbon-black-cloud-endpoint.html"}}]},{"text":" is a cloud-native endpoint, workload, and container protection platform that combines the intelligent system hardening and behavioral prevention needed to keep emerging threats at bay, using a single, easy-to-use console. By analyzing more than 1 trillion security events per day, VMware CBC proactively uncovers attackers’ behavior patterns and empowers defenders to detect and stop emerging attacks. ","type":"text"}]},{"type":"paragraph","content":[{"text":"This Devo collector helps to extend CBC's rich analytics and response actions to the rest of our customers' security stack.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data source description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"table","attrs":{"layout":"full-width","localId":"d3f11f57-73a3-4382-9c07-ad753319e818"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Data source","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Table","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Collector service","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Remote endpoint","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"endpoint.vmware.cbc_api.alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"event_alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"https://defense.conferdeploy.net/appservices/v6/orgs/{org_key}/alerts/_search","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Alerts Data Source indicates suspicious behavior and known threats in your environment.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Audit Logs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"endpoint.vmware.cbc_defender.audit_logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"event_audit_logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"https://defense.conferdeploy.net/integrationServices/v3/auditlogs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Audit Logs returns audit events in a system, such as when a user signs-in or updates a policy","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Vendor setup","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to configure the Devo - VMware Carbon Black Cloud collector, you need to create API credentials that will be used to authenticate API requests.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"fcee2f14-cb53-4f31-aa15-4ab46d816102"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Required setup actions by collector services","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"event_alerts","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"event_audit_logs","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Open your API Access console","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"✔","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"✔","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Create a new ","type":"text"},{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"✔","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Create a new ","type":"text"},{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"✔","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"type":"hardBreak"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Open your API Access console","type":"text"}]},{"type":"paragraph","content":[{"text":"VMware Carbon Black API Access console allows you to create, remove and edit your API credentials.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in to your Carbon Black Cloud console.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now navigate to ","type":"text"},{"text":"Settings","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"→ API Access","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":15.0},"content":[{"type":"media","attrs":{"width":396,"id":"1c0f0f3b-d286-4ba9-8fd7-c5143c0331fc","collection":"contentId-94639648","type":"file","height":644}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note down your ","type":"text"},{"text":"Org Key","type":"text","marks":[{"type":"strong"}]},{"text":", which is displayed at the top left of the console.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":30.0},"content":[{"type":"media","attrs":{"width":832,"id":"15ef9402-a2f1-4d11-a07a-3e2e55704a47","collection":"contentId-94639648","type":"file","height":206}}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a new ","type":"text"},{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"This token is required to run the ","type":"text"},{"text":"event_audit_logs ","type":"text","marks":[{"type":"code"}]},{"text":"service and retrieve the ","type":"text"},{"text":"Audit Logs","type":"text","marks":[{"type":"strong"}]},{"text":" data source.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On the top right, click ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" to open the creation screen. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3191,"id":"55030337-4749-4da2-86ce-c8a69dacf5d2","collection":"contentId-94639648","type":"file","height":1342}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" creation form:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":" - Type in a unique name for your API key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]},{"text":" - Enter an optional detailed description of the purpose of the credentials.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access level type","type":"text","marks":[{"type":"strong"}]},{"text":" - Select ","type":"text"},{"text":"API","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authorized IP address","type":"text","marks":[{"type":"strong"}]},{"text":" - Enter an optional list of authorized IP addresses that this API key can use.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3194,"id":"bca47a2b-d491-4374-bf33-566da1a18991","collection":"contentId-94639648","type":"file","height":1351}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". You will be prompted with a window displaying your API credentials (API ID and API Secret Key). Note them down.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3197,"id":"5b639e80-f230-402a-98f3-a10af86cd2eb","collection":"contentId-94639648","type":"file","height":1358}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Finally, generate the final token by combining your API ID and API Secret Key like in the following example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API ID","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Secret Key","type":"text","marks":[{"type":"strong"}]},{"text":" →","type":"text"},{"text":" 012345","type":"text","marks":[{"type":"em"}]}]}]}]}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"The final audit token would be → ","type":"text"},{"text":"ABCDEFGHIJKLMNOPQ/012345","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a new ","type":"text"},{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"This token is required to run the ","type":"text"},{"text":"event_alert","type":"text","marks":[{"type":"code"}]},{"text":" service and retrieve the ","type":"text"},{"text":"Alert","type":"text","marks":[{"type":"strong"}]},{"text":" data source.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generic tokens require an associated ","type":"text"},{"text":"Access Level","type":"text","marks":[{"type":"strong"}]},{"text":". On the top left, click the ","type":"text"},{"text":"Access Levels","type":"text","marks":[{"type":"strong"}]},{"text":" tab.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On the top right, click on ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"Add Access Level ","type":"text","marks":[{"type":"strong"}]},{"text":"to open the creation screen.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3196,"id":"c6cb74a4-f536-43b1-8f32-7d7c9b6dbcaa","collection":"contentId-94639648","type":"file","height":1356}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add Access Level","type":"text","marks":[{"type":"strong"}]},{"text":" creation form","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":" - Type in a unique name for your API key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]},{"text":" - Type in a detailed description of the purpose of the credentials.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Required permissions","type":"text","marks":[{"type":"strong"}]},{"text":" - Add the following permission levels to enable the ","type":"text"},{"text":"event_alert","type":"text","marks":[{"type":"code"}]},{"text":" service:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.retention","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.alerts.notes","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.alerts","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"device","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Read","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3199,"id":"143d3b05-31ea-4c81-9dba-5d489933a1cf","collection":"contentId-94639648","type":"file","height":1388}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Now, go to the ","type":"text"},{"text":"API Keys","type":"text","marks":[{"type":"strong"}]},{"text":" tab and click ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" at the top right area.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fill out the ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" creation form:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":" - Type in a unique name for your API key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]},{"text":" - Enter an optional detailed description of the purpose of the credentials.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access level type","type":"text","marks":[{"type":"strong"}]},{"text":" - Select ","type":"text"},{"text":"Custom,","type":"text","marks":[{"type":"em"}]},{"text":" and you'll be prompted to select a","type":"text"},{"text":" C","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"ustom Access Level","type":"text","marks":[{"type":"strong"}]},{"text":". Select the ","type":"text"},{"text":"Access Level","type":"text","marks":[{"type":"strong"}]},{"text":" role that you created in step 3.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authorized IP address","type":"text","marks":[{"type":"strong"}]},{"text":" - Enter an optional list of authorized IP addresses that this API key can use.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":3194,"id":"9bb64d92-b67f-4ea9-8a33-36dbe9a35490","collection":"contentId-94639648","type":"file","height":1351}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":". You will be prompted with a window displaying your API credentials (API ID and API Secret Key). Note them down.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Finally, generate the final token by combining your API ID and API Secret Key like in the following example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API ID","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"012345","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"API Secret Key","type":"text","marks":[{"type":"strong"}]},{"text":" →","type":"text"},{"text":" ABCDEFGHIJKLMNOPQ","type":"text","marks":[{"type":"em"}]}]}]}]}]}]},{"type":"paragraph","content":[{"text":" The final audit token would be ","type":"text"},{"text":"→ ABCDEFGHIJKLMNOPQ/012345","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"full-width","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"51c8f0ae-a00f-4ec9-807a-3e1bc4f90ea5"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tabs.png"}}],"title":"UI Tabs"}},"localId":"f237ecea-4668-479f-ba8e-87b28d14a0e3"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"31c1ff92-e916-4b98-af29-6195e62d79c1"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"UI Tab"}},"localId":"bd0f65e2-8ebe-440d-a140-702f4630ea77"}},{"type":"paragraph","content":[{"text":"We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, ","type":"text"},{"text":"get in touch with us","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:support@devo.com"}}]},{"text":" and we will guide you through the configuration.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"4baf4f40-4f47-40ff-aafb-dc8cad47e70b"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"UI Tab"}},"localId":"c9c20760-fd71-4444-bfcc-fb6f0fdb40f5"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"structure"}},"macroMetadata":{"macroId":{"value":"7a96c7e1-cc3b-4732-ac2b-e620a0fe6a0e"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"714603de-25f0-447a-b4da-ef77c060f230"}},{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for being used when running the collector:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── devo-collector-vmware-carbonblackcloud/\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n └── config/ \n └── config-vmware-carbonblackcloud.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"devocredentials"}},"macroMetadata":{"macroId":{"value":"eab6b2be-aa15-4d29-82a6-73a759cd1447"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"df10cfe0-ae1a-43fa-9371-bf615c918124"}},{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text"},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text"},{"text":"devo-collector-vmware-/certs/","type":"text","marks":[{"type":"code"}]},{"text":". Learn more about security credentials in Devo ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/pages/createpage.action?spaceKey=NDT5&title=X.509%20certificates"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":60.0},"content":[{"type":"media","attrs":{"width":1822,"id":"2806567a-db49-4ab4-a228-63fbe1a9d3e0","collection":"contentId-94639648","type":"file","height":471}}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"awscredentials"}},"macroMetadata":{"macroId":{"value":"907b08d6-6330-4bd7-8a6f-7547aaa994ac"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"110d1257-a94c-44ea-8ed7-166bde89d3ab"}},{"text":"Editing the config.yaml file","type":"text"}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: true\n id: \n name: \n persistence:\n type: filesystem\n config:\n directory_name: state\n multiprocessing: \n\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: \n port: 443\n type: SSL\n chain: \n cert: \n key: \ninputs:\n carbonblackcloud:\n id: \n enabled: \n requests_per_second: \n override_base_url: \n credentials:\n generic_token: \n audit_token: \n org_key: \n services:\n event_alerts:\n request_period_in_seconds: \n last_update_time:\n start: \n event_audit_logs:\n request_period_in_seconds: \n","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the placeholders with your required values:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"2a2e57de-f2b0-4292-a760-fe5c65ed213c"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Value range","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"collector_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"5","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a unique ID to this collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"collector_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"10","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a valid name to this collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"multiprocessing_mode","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":"/","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"If the value is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", the collector will run using a multiprocessing architecture. If the value is ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":", the collector will use only one CPU.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"devo_address","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"collector-us.devo.io","type":"text","marks":[{"type":"link","attrs":{"href":"http://collector-us.devo.io/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"collector-eu.devo.io","type":"text","marks":[{"type":"link","attrs":{"href":"http://collector-eu.devo.io/"}}]}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the Devo Cloud where the events will be sent.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"chain_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"4","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"20","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the chain.cert file downloaded from your Devo domain. Usually, this file's name is ","type":"text"},{"text":"chain.crt","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"cert_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"4","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"20","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the file.cert downloaded from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"key_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"4","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"20","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to identify the file.key downloaded from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"input_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Maximum length: ","type":"text"},{"text":"5","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Use this param to give a unique ID to this input service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"input_status","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"bool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":"/","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"If the value is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", the input definition will be executed. If the value is ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":", the service will be ignored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"requests_per_second","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum value: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Customize the maximum number of API requests per second. If not used, the default setting will be used (100000 requests/sec)","type":"text"}]},{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed, or commented.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"override_base_url","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Valid URL","type":"text"}]},{"type":"paragraph","content":[{"text":"Regex: ","type":"text"},{"text":"(\"((http|https)://)(www.)?\" + \"[a-zA-Z0-9@:%._\\\\+~#?&//=]\" + \"{2,256}\\\\.[a-z]\" + \"{2,6}\\\\b([-a-zA-Z0-9@:%\" + \"._\\\\+~#?&//=]*)\")","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Set a custom value to override the default URL (","type":"text"},{"text":"https://defense.conferdeploy.net","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://defense.conferdeploy.net"}}]},{"text":")","type":"text"}]},{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed, or commented.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"generic_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Required in the request header. This is your authentication token for the Alerts and Live Query endpoints.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"audit_token","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Required in the request header. This is your authentication token for the Audit Log endpoint.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"org_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Required for the API path. This is your Carbon Black Cloud Org Key, you can view it under ","type":"text"},{"text":"Settings → API Keys","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Minimum length:","type":"text"},{"text":" 1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Period in seconds used between each data pulling, this value will overwrite the default value (300 seconds)","type":"text"}]},{"type":"paragraph","content":[{"text":"This parameter can be left blank, removed or commented.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"start","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Format expected: ","type":"text"},{"text":"YYYY-MM-DD HH:MM:SS","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter used by the collector as the starting ","type":"text"},{"text":"UTC","type":"text","marks":[{"type":"code"}]},{"text":" point when it first pulls data.","type":"text"}]},{"type":"paragraph","content":[{"text":"Updating this value will produce the loss of all persisted data and current pipelines.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"c0377ca8-b948-47ce-97e5-7af7ee38442a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[693.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[693.0]},"content":[{"type":"paragraph","content":[{"text":"collector-vmware-carbonblackcloud-docker-image-1.1.0.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1h3WVnSEjwgSmHyF7Pgp477Ub26T42WMb/view?usp=sharing"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"94e27a4a7413eda12092a64c902671d912ea0814759c7b369599d4a14a9c7cbe","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"codeBlock","content":[{"text":"gunzip -c collector-vmware-carbonblackcloud-docker-image-.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace \"","type":"text","marks":[{"type":"textColor","attrs":{"color":"#5c5c5c"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"\" with a proper value","type":"text","marks":[{"type":"textColor","attrs":{"color":"#5c5c5c"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Docker","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/confluence/ndt/v7.10.0/sending-data-to-devo/collectors/vmware-carbon-black-cloud-collector#VMwareCarbonBlackCloudcollector-docker"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Docker Compose","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/confluence/ndt/v7.10.0/sending-data-to-devo/collectors/vmware-carbon-black-cloud-collector#VMwareCarbonBlackCloudcollector-dockercompose"}}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"docker"}},"macroMetadata":{"macroId":{"value":"bacfce02-0eb5-4c55-ba06-0000bdd5924c"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"3fffa426-96ed-4375-9e25-6cf159dd68c1"}},{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors/vmware-carbonblackcloud/","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \\\n--name collector-vmware-carbonblackcloud\\\n--volume $PWD/certs:/devo-collector/certs \\\n--volume $PWD/config:/devo-collector/config \\\n--volume $PWD/state:/devo-collector/state \\\n--env CONFIG_FILE=config-vmware-carbonblackcloud.yaml \\\n--rm -it docker.devo.internal/collector/vmware-carbonblackcloud:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required value.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"dockercompose"}},"macroMetadata":{"macroId":{"value":"9f9f777d-3e59-4d3a-92b3-a185ce02a151"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"12a6e7c7-503e-4d2c-8cb2-789c15775058"}},{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors/vmware-carbonblackcloud/","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-vmware-carbonblackcloud:\n image: docker.devo.com/collector/vmware-carbonblackcloud:${IMAGE_VERSION:-latest}\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config-vmware-carbonblackcloud.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]},{"text":"/devo-collectors/vmware-carbonblackcloud/","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required value.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"API limitations","type":"text"}]},{"type":"paragraph","content":[{"text":"Rate limiting is currently not enforced. However, excessive usage is monitored. Excessive usage can result in temporary enforcement of rate-limiting.","type":"text"}]}],"version":1}

Browser not supported