Edit Forwarder

PUT {{cb_url}}/data_forwarder/v2/orgs/{{cb_org_key}}/configs/{{cb_forwarder_id}}

This call is used to edit an existing forwarder. The Type (e.g. Alert, Endpoint Event, Watchlist Hit) and Destination
(also called Provider, awss3 or azureblob_storage) cannot be changed; all other configuration values can be modified.

When editing an existing forwarder, the API will make additional calls to check whether the Carbon Black Cloud forwarder can write to the specified destination using the configuration supplied. It will attempt to write a test message called healthcheck.json to the specified bucket under a subfolder called healthcheck, or Azure Container. If the bucket is misconfigured (e.g. incorrect permissions, principle arn, etc.) or the configuration is incorrect (e.g. bucket prefix doesn’t match path specified in policy or bucket does not exist), the Data Forwarder Configuration API will respond with a 400 and message including information regarding what was incorrect, providing the customer with feedback that enables them to fix issues as needed.

If you want to remove filters that are applied to your configuration then use the Delete Filter endpoint.

RBAC Permissions Required

Request Body

{"enabled"=>true, "name"=>"Alert Forwarder v2.0.0 - the latest and greatest", "type"=>"alert", "version_constraint"=>"1.0.0", "destination"=>"aws_s3", "s3_bucket_name"=>"demo-bucket", "s3_prefix"=>"demo-uae", "azure_storage_account"=>"azuredemo", "azure_container_name"=>"azure-event-demo", "azure_tenant_id"=>"a12345bc-1abcd-1a2b-a1b2-ab12c3de45f6", "azure_client_id"=>"X98766yz-z987-z9x8-z9x8-zx98y7vw65u4"}

HEADERS

RESPONSES

status: OK

{"id":"6d34c7d6-2272-11ee-a854-429d08efd8d3","org_key":"ABCD1234","name":"Alert Forwarder v1.0.0 - the original and deprecated","enabled":true,"s3_bucket_name":"demo-bucket","s3_prefix":"demo-alert","type":"alert","version_constraint":"1.0.0","current_version":"1.0.0","create_time":"2023-07-14T18:15:34Z","update_time":"2023-07-14T18:17:34Z","destination":"aws_s3"}