Managing the Carbon Black Cloud Integration (Connector)

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

More information on the Carbon Black Cloud Integration and how to enable it via the Connector.

Environment

• App Control Console: All Supported Versions
• Carbon Black Cloud: All Supported Versions

Resolution

Enable Carbon Black Cloud Integration

1. Log in to the App Control Console and navigate to Settings > System Configuration > Connectors.
2. Choose the Carbon Black Cloud tab and click Edit
3. Complete details accordingly
   1. Enable Carbon Black Cloud Integration: Check to enable
   2. Cloud Enterprise EDR: Choose accordingly for your environment
      • Requires the Enterprise EDR entitlement in Carbon Black Cloud.
      • Determines the number and type of URL fields displayed.
   3. Populate from URL: Use the relevant Cloud Dashboard URL for your environment
      • The base portion of the URL can be entered with or without https:// and with or without a trailing slash.
   4. Verify the URLs are filled correctly.
4. Click Update.

 

Using the Carbon Black Cloud Integration

Notes: Endpoints must also have a Carbon Black Cloud Sensor installed. The entitlement for Enterprise EDR is not the same as the Carbon Black EDR (formerly Response) product. The Cloud Integration will not Detect/report whether a Cloud Sensor is also installed on the endpoint. Change the Carbon Black EDR status on the Computer Details page.

 

After the Cloud Integration is configured and activated, links on File Details, Fine Instance Details and Computer Details pages will be available. Clicking the links will take you to the relevant area of the Carbon Black Cloud Console:

App Control Console	Navigation Breadcrumbs	Link Name	Cloud Console Target Location
Computer Details Page	Assets > Computers > relevant Computer	Carbon Black Cloud Device	Inventory > Endpoints: Search for relevant machine name
Computer Details Page	Assets > Computers > relevant Computer	Carbon Black Cloud Events	Investigate: Search for events matching machine name
File Details Page	Assets > Files > Relevant file > View Details (pencil icon)	Carbon Black Cloud Events	Investigate: Search events matching file hash
Process Name Column	Reports > Events > Column: Process Name	Cloud icon next to Process	Investigate: Search events matching process hash

Additional Information

• More information available in the User Guide section: Enabling Carbon Black Cloud Integration
• The Carbon Black Cloud Enterprise EDR choice determines the number and type of URL fields displayed.