How To Request a Carbon Black Cloud Org be Decommissioned

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)

Issue/Introduction

To remove a Carbon Black Cloud org / request that it be decommissioned (deleted).

Environment

• Carbon Black Cloud: All Versions

Resolution

Step 1: Self-Serve

If your license has not expired, it is preferable that customers, as data controllers, perform these actions in order to confirm that the data is removed on their own schedule. If your license has already expired and you have lost access to your org, skip to step 2.

1. Remove all the CBC sensors from devices.
   • Customers should ensure no sensors are displayed in the CBC console.
   • Devices can be uninstalled and removed in bulk from the CBC console.
2. Regenerate the sensor install code to prevent new automated installations.
3. Remove all alert configurations, sensor groups, policies, etc.
4. Remove all API keys.
5. Remove all users except the user that is performing the operation.
6. Save your Company Deregistration Code

Once these actions are complete most of the data associated with the tenant will either be immediately removed or start to age out. The vast majority of sensor data (sensor telemetry) ages out after 30 days. 

 

Step 2: De-registration

A User Administrator, Product Administrator, or Carbon Black Cloud Super Admin can request a de-registration request by contacting Broadcom via a non-technical support case. In the request provide the following statement:

 

I request the de-registration and complete removal of data for the following Carbon Black Cloud organization

Org ID	Org Key	Tenant Name

 

Step 3: Org is Removed

34 days after deregistration is initiated the data will be purged from Carbon Black systems (30 day grace period, followed by a 3 day holding period, followed by the actual destruction)

Additional Information

• If you'd like immediate deprovisioning, include that request in the non-technical case.
• If the org information is unknown, provide an email address associated with the Carbon Black Cloud org.
• What happens when a Carbon Black Cloud license expires