Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.

Get started with the Carbon Black - Incident Enrichment integration

Log in to subscribe to topics and get notified when content changes.

Get started with the Carbon Black - Incident Enrichment integration

The Carbon Black incident enrichment facilitates the investigation of a security incident by querying logs for potentially malicious indicators. Before you can use the Carbon Black - Incident Enrichment integration, you must activate the plugin and add the appropriate Endpoint Base URL and MID server.

Before you begin

Role required: sn_si_admin
Important: If you have upgraded your instance from an earlier version, but prior to configuring the Carbon Black - Incident Enrichment integration, please contact ServiceNow support to manually activate the Core Automation API (com.snc.core.automation.api) plugin before attempting to configure this integration. The configuration will not function properly if this action is not taken.

About this task

This procedure can be used to activate the plugin and configure the integration. You can also activate the plugin using the traditional method. If you activate the plugin using the traditional method, the Carbon Black - Incident Enrichment integration recognizes the installation and the integration card displays the New button. Proceed to step 6.


  1. Access the Carbon Black website and obtain the Endpoint Base URL and API Token under your profile.
  2. Navigate to Security Operations > Integrations > Integration Configuration.
    The available security integrations appear as a series of cards.
    Carbon Black - Incident Enrichment plugin card
  3. In the Carbon Black - Incident Enrichment card, click Install Plugin.
  4. In the Install Carbon Black - Incident Enrichment dialog box, review the plugin details and click Activate.
  5. When the activation is complete, click Close & Reload Form.
    The Security Integration screen reloads and the New button for the integration is available.
  6. Click New.
    Carbon Black Incident Enrichment
  7. Fill in the fields, as needed.
    Field Description
    Name The name of this configuration.
    Endpoint Base The endpoint URL you acquired from the Carbon Black site.
    Link URL [Optional] The Link URL that links to a Carbon Black instance, when available.
    API Token The API token you acquired from the Carbon Black site.
    Max Rows The maximum number of rows you want to search. The default is 1000 rows.
    Earliest Result (days) The earliest results you want to see in number of days.
    Perform binary and process search Select this to perform binary searches to find binary files such as file hashes, and process searches for .exe processes that may have run.
    Include raw data samples in search results Select this to include samples of raw data in your sightings search results. The amount of data returned depends on your setting in the number of rows of raw data property in Security Incident Response properties.
    MID Server Select Any to use any active MID Server, or select a specific MID Server name.
    Note: Configuring this integration activates workflows. To manage the workflows, navigate to the Workflow Editor.
  8. Click Submit.
    The integration configuration card displays.
  9. When viewing the new configuration card, you can click Configure or Delete to change or delete the configuration, respectively.
  10. To return to the original list of integration configuration cards, select No from the Show Configurations drop-down list.