carbonblack / cb-lastline-connector

Carbon Black - LastLine Binary Detonation Connector

VMware Carbon Black EDR - Lastline Connector

NOTE: This connector integrates the VMWare Carbon Black EDR product with Lastline. Integration with VMWare Carbon Black Cloud products, including "NGAV" and "Enterprise EDR" is not included here. The Lastline connector submits binaries collected by the VMware Carbon Black EDR to a Lastline appliance for binary analysis. The results are collected and placed into an Intelligence Feed on your VMWare Carbon Black EDR server. The feed will then tag any binaries executed on your endpoints identified as malware by Lastline. Only binaries submitted by the connector for analysis will be included in the generated Intelligence Feed.

Installation Quickstart

As root on your VMWare Carbon Black EDR or other RPM based 64-bit Linux distribution server:

cd /etc/yum.repos.d
curl -O https://opensource.carbonblack.com/release/x86_64/CbOpenSource.repo
yum install python-cb-lastline-connector

Once the software is installed via YUM, copy the /etc/cb/integrations/lastline/connector.conf.example file to /etc/cb/integrations/lastline/connector.conf. Edit this file and place your Carbon Black API key into the carbonblack_server_token variable and your Carbon Black server's base URL into the carbonblack_server_url variable.

Then you must place your credentials for Lastline into the configuration file: place your API key and API token respectively into the lastline_api_key and lastline_api_token variables in the /etc/cb/integrations/lastline/connector.conf file.

If you are using an on-premise Lastline appliance, make sure to place the URL for your on-premise Lastline appliance in the lastline_url variable and set lastline_url_sslverify to 0 if your appliance does not have a valid SSL certificate.

Any errors will be logged into /var/log/cb/integrations/lastline/lastline.log.

Ensure that the configured API credentials are upto date, and have permissions to submit files for analysis.

Troubleshooting

If you suspect a problem, please first look at the Lastline connector logs found here: /var/log/cb/integrations/lastline/lastline.log (There might be multiple files as the logger "rolls over" when the log file hits a certain size).

If you want to re-run the analysis across your binaries:

1. Stop the service: service cb-lastline-connector stop
2. Remove the database file: rm /usr/share/cb/integrations/lastline/db/sqlite.db
3. Remove the feed from your Cb server's Threat Intelligence page
4. Restart the service: service cb-lastline-connector start

Support

• View all API and integration offerings on the Developer Network along with reference documentation, video tutorials, and how-to guides.
• Use the Developer Community Forum to discuss issues and get answers from other API developers in the Carbon Black Community.
• Report bugs and change requests to Carbon Black Support.

cb-lastline-connector's Issues

Old reports never age out, and the score never gets updated from Lastline

The integrations should have a way to age out old reports like the FireEye integration has. This could be controlled by an option in the configuration file, or a static setting. Also, scores change, sometimes drastically (usually down). A rescan is really needed like CB does with VirusTotal.

Lastline connector logs do not indicate trouble with invalid credentials

Logs show good connection to lastline analysis server. No indication the access key and api token were not acceptable.

sqlite3 query provides amplifying information:
291617757D108D10AB9E2DEDD401A60A|2015-12-14 17:59:22.214944|2015-12-14 17:59:18.001032|2015-12-14 18:01:22.101453||0|10|API error: Analysis API error (104): Invalid Credentials||0||||0|1

CB R lastline connector 'view on lastline' link directing to incorrect URL

When clicking the "View on Lastline" link in CBR they are getting sent to https://user.lastline.customerdomain/malscape/#/task/.

They say the correct URL should be https://user.lastline.customerdomain/portal#/analyst/task/

Unable to find ".../cbapi/defense/models/*" when adding binary and data files.

While trying to build the RPM using "python setup.py bdist_binaryrpm" I get this error. When I look in the cbapi I see that defense models are now under psc, if I change the spec file to use /cbapi/psc/defense/... I can build the RPM fine, but the resulting RPM won't run.

Is there a guide for building and installing from source?

Kind regards,