Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.

Get started with the Carbon Black integration

Log in to subscribe to topics and get notified when content changes.

Get started with the Carbon Black integration

Carbon Black is an advanced security system easily integrating with Security Operations. Before you can use the Carbon Black integration, you must activate the plugin and add the appropriate Endpoint Base and API Token.

Before you begin

Role required: sn_si_admin
Note: This procedure can be used to activate the Security Operations Carbon Black Integration plugin and configure the integration. You can also activate the plugin using the traditional method. If you activate the plugin using the traditional method, the Carbon Black integration recognizes the installation and the integration card displays the New button. Proceed to step 6.


  1. Access the Carbon Black website and obtain the Endpoint Base URL and API Token under your profile.
  2. Navigate to Security Operations > Integrations > Integration Configurations.
    The available security integrations appear as a series of cards.
    Carbon Black integration card
  3. In the Carbon Black card, click Install Plugin.
  4. In the Install Carbon Black integration dialog box, review the plugin details and click Activate.
  5. When the activation is complete, click Close & Reload Form.
    The Security Integration screen reloads and the Integration Configuration card shows the New button.
  6. Click New.
    Carbon Black Configuration
  7. Fill in the fields, as needed.
    Field Description
    Name The name of this configuration.
    Endpoint Base The endpoint base you acquired from the Carbon Black site.
    API Token The API token you acquired from the Carbon Black site.
    Use MID Server Select this check box if it is not already checked.
    MID Server Select Any to use any active MID Server, or select a specific MID Server name.
    Enable Isolate Host Select this check box to allow selected configuration items to be isolated from the Configuration Items related list tab in a security incident.
    Note: Configuring this integration activates workflows. To manage the workflows, navigate to the Workflow Editor.
  8. Click Submit.
    The integration configuration card displays.
  9. When viewing the new configuration card, you can click Configure or Delete to change or delete the configuration, respectively.
  10. To return to the original list of integration configuration cards, select No from the Show Configurations drop-down list.