pySigma-backend-carbonblack

pySigma CarbonBlack Backend

This is the carbonblack backend for pySigma. It provides the package sigma.backends.carbonblack with the CarbonBlackBackend class. Further, it contains the following processing pipelines in sigma.pipelines.carbonblack:

• CarbonBlack_pipeline: Uses Carbon Black Enterprise EDR field mappings
• CarbonBlackResponse_pipeline: Uses Carbon Black EDR field mappings

It supports the following output formats:

• default: plain CarbonBlack queries
• json: JSON output to include query and rule metadata

This backend is currently maintained by:

• Cori Smith

Side Notes & Limitations

• Backend uses Carbon Black syntax
• Pipelines exist for both Carbon Black Enterprise EDR and Carbon Black EDR
• Pipelines support linux, windows, and macos product types
• Pipelines support the following category types for field mappings
  • process_creation
  • file_event
  • file_change
  • file_rename
  • file_delete
  • image_load
  • registry_add
  • registry_delete
  • registry_event
  • registry_set
  • network_connection
  • firewall
• Any unsupported fields or categories will throw errors