Initialize the Carbon Black Cloud Beat | LogRhythm Documentation

This section provides instructions to initialize Carbon Black Cloud Beat after configuration. It is primarily focused on the alert log to be pulled from the Carbon Black Cloud console.

Prerequisites

Open Collector is installed. If you have not already installed it, follow the instructions in the Open Collector Installation and User Guide, and then return to this topic.
Carbon Black Cloud console hostname. You should have received the hostname when you purchased the Carbon Black Cloud platform.

For more information on hostname:

https://developer.carbonblack.com/reference/carbon-black-cloud/authentication/#hostname

.

You must omit the https:// from the hostname for the beat to work properly. If you do not do this, the beat will continuously restart.
Carbon Black Cloud console API Credentials and Organization Key. If you do not have these, follow the instructions here Configure API Access on Carbon Black Cloud Console, and then return to this topic.
A sensor installed on one of your machines to sync the alerts on the Carbon Black Cloud console. This sensor can be installed using the sensor option provided on the Carbon Black Cloud console under Endpoints.

The following port is open:

Direction	Port	Protocol	Source
Outbound	443	HTTPS	carbonblackcloudbeat

Initialize the Beat via the Web Console (Recommended)

Ensure that the Open Collector Connection to the SIEM (WebUI) setup has been completed.
Ensure that the System Monitor Agent to which you intend to send these logs has been Configured for JSON Parsing.

Use either the Enable JSON Parsing on System Monitor Agents or the Enable JSON Parsing for an Existing System Monitor Agent sections at the above link to configure the System Monitor Agent for JSON Parsing.

Follow the steps outlined in Add a Beat in the Web Console to create the Beat via the Web UI.

Initialize the Beat via Command Line (Legacy)

Start the Beat:
```
./lrctl carbonblackcloudbeat start
```
Use the Up and Down Arrow keys to select New carbonblackcloudbeat instance from the list, and then press Enter.
Enter a unique beat identifier for this carbonblackcloudbeat instance.
Enter the Hostname.

Refer to the

VMware Carbon Black Cloud documentation

to verify what the Hostname should be.
Enter the API ID.

For security purposes the API ID is stored in encrypted format.
Enter the API Secret Key.

For security purposes the API Secret Key is stored in encrypted format.
Enter the Organization Key.

For security purposes the Organization Key is stored in encrypted format.
Enter the hostname or IP address of the System Monitor Agent that has been Configured for JSON Parsing, and then press Enter.

Enter the port on which the System Monitor Agent is configured to listen for JSON data (the default is 5044), and then press Enter.
The carbonblackcloudbeat service started message appears.
Check the status of the service to confirm that it’s running:
```
./lrctl carbonblackcloudbeat status
```
(Optional) Edit the carbonblackcloudbeat configuration to update the values set above if needed. Ensure that you have all the needed information for each step available as you will need to re-enter it:
```
./lrctl carbonblackcloudbeat config edit                   
```

Default Config Values for the Carbon Black Cloud Beat:

S.No	Field Name	Default Values
1	heartbeatinterval	60s
2	heartbeatdisabled	false
3	period	2s
4	apiID	User Provided
5	secretKey	User Provided
6	numbackdaysData	7 Number of back days must be a non-negative number. Only 180 days of back log data is supported. Therefore the range for this value is 1-180 days.
7	orgKey	User Provided
8	hostname	User Provided
9	limit	1000 Supported limit range is 100-1000

Note:

There can be a slight delay (up to 1 min) in syncing alerts due to a network issue depending upon the sensor sync alert on Carbon Black Cloud.