⚠️ Edit Forwarder
PUT {{cb_url}}/data_forwarder/v1/orgs/{{cb_org_key}}/configs/{{cb_forwarder_id}}
This call is used to edit an existing forwarder. You can edit the Enabling/Disabling functionality or change the s3 bucket name.
When editing an existing forwarder, the API will make additional calls to check whether the Carbon Black Cloud event or alert forwarder can write to the specified S3 Bucket using the configuration supplied. It will attempt to write a test message called healthcheck.json to the specified bucket. If the bucket is misconfigured (i.e. incorrect permissions, principle arn, etc.) or the configuration is incorrect (i.e. bucket prefix doesn’t match path specified in policy or bucket does not exist), the Event Forwarder Configuration API will respond with a 400 and message including information regarding what was incorrect, providing the customer with feedback that enables them to fix issues as needed.
If you want to remove filters that are applied to your configuration then update the configuration with an empty array for the filters property.
RBAC Permissions Required
| Permission (.notation name) | Operation(s) |
|---|---|
| event-forwarder.settings | UPDATE |
Schema
| Field | Definition | Data Type | Values | Required |
|---|---|---|---|---|
name | Defined name for the specific event or alert forwarder | String | N/A | Yes |
s3_bucket_name | Configured unique name for s3 bucket | String | N/A | Yes |
s3_prefix | Defined folder structure the forwarder will write events or alerts to | String | N/A | Yes |
type | The datastream type that is to be forwarded. | String | endpoint.event, alert | Yes |
filters | A list of filters to apply to the data being forwarded. Use only one of equals, not_equals, or match_any_bits per filter in the list. Only supported when type equals endpoint.event | Array | [{ "attribute": "<string>", "equals": "<string>", "not_equals": "<string>", "match_any_bits": ["<string>", "<string>"]}] | No |
Request Body
{"name"=>"<string>", "s3_bucket_name"=>"<string>", "s3_prefix"=>"<string>", "type"=>"<string>", "filters"=>[{"attribute"=>"<string>", "equals"=>"<string>", "not_equals"=>"<string>", "match_any_bits"=>["<string>", "<string>"]}]}
HEADERS
| Key | Datatype | Required | Description |
|---|---|---|---|
Content-Type | string |