Threat Intelligence Data Sharing Settings

Most of Carbon Black’s threat intelligence feed partners provide a list of all of the IOCs they track, and almost all feeds require that you enable communication on the Sharing Settings page. Also, some feeds require that you enable data sharing.

Important:

Management of Sharing Settings is only available to Carbon Black EDR Global Administrators and Carbon Black Hosted EDR Administrators.

Enable Sharing Communications

Perform the following procedure to enable sharing communications.

Procedure

1. Click Username > Sharing Settings.
2. Under General Sharing Settings, specify sharing settings for Alliance:

   • Enable Alliance Communication – Enables communication with Carbon Black. It also allows download of binaries from the Alliance and the ability to retrieve Alliance feeds.

   • Support the Alliance Threat Intelligence Community – Enables your server to send threat intelligence statistics to Carbon Black, including alert resolutions, ignored reports, and feed ratings. These statistics improve the efficacy of Carbon Black-provided threat intelligence and give you a community consensus on the ratings of feeds and threat indicators.

3. Specify sharing settings for statistics and diagnostics data:
   • Enable Performance Statistics – Enables sharing of usage, resource, and sensor statistics with Carbon Black.

   • Allow Unattended Background Upload of Diagnostics Data – Enables the Carbon Black EDR server to do background collection of diagnostics data such as application logs and configuration files to facilitate troubleshooting with VMware Carbon Black Customer Support. Requires Enable Performance Statistics to be enabled.
   • Allow Upload of Sensor Diagnostics Data – This setting determines whether the Carbon Black EDR server can upload diagnostics data gathered from deployed endpoint sensors to Carbon Black for troubleshooting. Options are as follows:

     • Disabled – No sensor diagnostics data can be uploaded to Carbon Black.

     • Manual – You can manually upload sensor diagnostics data by using a utility that is installed on the sensor.

     • Automatic – Sensor diagnostics data is automatically uploaded when fault conditions are detected on the sensor.

   Note: Manual or Automatic upload of sensor diagnostics data requires the Enable Performance Statistics option to be selected.
4. 
   

Enable Data Sharing with Carbon Black Threat Intel Feed Partners

Perform the following procedure to enable data sharing with Carbon Black Threat Intel feed partners.

Prerequisites

To enable data sharing with feed partners in the Carbon Black Alliance, Enable Alliance Communication must first be selected.

Procedure

1. Click Username > Sharing Settings.
2. Scroll to Endpoint Activity Sharing.
3. Decide whether to share the following types of data with VMware Carbon Black Inspection (Complete Binaries only) or Carbon Black:

   • Binary Hashes & Metadata

   • Complete Binaries

   • Response Event Data

4. Click the current setting (Enabled, Disabled, or Partial) to specify the default sharing setting for sensor groups.
   Important: In the resulting Share dialog, read the Summary, Data Shared, and Privacy sections carefully before making further selections.
5. The following options are available at the bottom of each Share dialog:

   • Select ENABLE (Share from ALL Groups) to share data from endpoints in all sensor groups.

   • Select DISABLE (Do Not Share from ANY Groups) to disable data sharing from endpoints in all sensor groups.

   • Select PARTIAL (Share from SOME Groups) to share data from endpoints in some sensor groups. Use the arrows between the SHARE FROM and DO NOT SHARE FROM windows to choose the groups that are allowed to share data.

   
6. Click Share to begin sharing the data.