The Airgap tool helps you import Carbon Black EDR-provided threat intelligence feeds into Carbon Black EDR servers that are installed inside an isolated network.
This script exports a subset of the Carbon Black Collective Defense Cloud Threat Intelligence Feeds into a set of JSON files that can be copied and imported into an airgapped Carbon Black EDR server.
The following feeds are supported by this tool:
abuse.ch Indicators of Compromise
Malware Domain List
Tor exit nodes
Carbon Black Advanced Threat Indicators
Carbon Black Community Feed
Carbon Black Early Access Feed
Carbon Black Suspicious Indicators
Carbon Black Endpoint Visibility Feed
Carbon Black Known IOC Feed
SANS Threat Hunting Feed
AlienVault Open Threat Exchange
Facebook Threat Exchange TLP White Indicators
MITRE ATT&CK Feed
Other Carbon Black Collective Defense Cloud feeds cannot be exported because they require the target Carbon Black EDR server to be online and actively communicating with the Collective Defense Cloud.
For support of the Airgap tool:
- View all API and integration offerings on the VMware Carbon Black EDR Developer Network, together with reference documentation, video tutorials, and how-to guides.
Use the Developer Community Forum to discuss issues and get answers from other API developers in the VMware Carbon Black Community.
Report bugs and change requests to VMware Carbon Black Support.
Run the Airgap Tool
Use the Airgap tool to provide feeds from the Carbon Black Collective Defense Cloud to an airgapped Carbon Black EDR server.
The source server runs the script in export mode to download the feeds from the Carbon Black Collective Defense Cloud and save them to a local directory. This directory is then burned to CD, copied to USB, or otherwise transferred to the destination server through a secure means. The folder includes a copy of the script plus the contents of all the feeds exported from the Carbon Black Collective Defense Cloud.
After the folder arrives at the destination server, the script is run in import mode to import the feed contents into the isolated Carbon Black EDR server. This process can be repeated on a regular basis to keep the copies of the feeds on the destination server synchronized with the feeds from the Carbon Black Collective Defense Cloud.
To use this tool, you need two Carbon Black EDR servers: one that has Internet access and the Carbon Black Collective Defense Cloud (the source), and one Carbon Black EDR server that is disconnected from the Internet (the destination).
- Run the
/usr/share/cb/cbfeed_airgapscript on the source system using an
-fargument to indicate the folder where the feeds should be saved. This folder can be on a mounted USB stick, or a temporary directory that will be burned to CD-ROM. For example:
# ./usr/share/cb/cbfeed_airgap export -f /tmp/blah exporting threat intelligence feeds to /tmp/blah # cp -rp /tmp/blah /media/USB # umount /media/USB ...Note: Include a
-voption for verbose logging to /var/log/cb/cli/cli.log.
- Copy the files to the destination server.
- Go to the directory that contains the script and feeds folder that you copied from the source server.
- Run the /
usr/share/cb/cbfeed_airgapscript on the destination system in import mode. For example:
# ./usr/share/cb/cbfeed_airgap import importing threat intelligence feeds from /media/USB ...