Integrating with VMware Carbon Black Cloud Endpoint Standard

Overview

Blumira’s modern SIEM platform integrates with VMware Carbon Black Cloud Endpoint Standard (formerly Carbon Black Defense) to detect cybersecurity threats and provide an automated or actionable response to remediate when a threat is detected on an endpoint.

Once configured, Blumira’s integration with VMware Carbon Black Cloud Endpoint Standard will stream server and workstation endpoint security event logs and alerts to the Blumira service for threat detection and actionable response.

Before you begin

Before you can configure the Blumira Cloud Connector, gather these credentials from Carbon Black to be used in later steps:

• Hostname URL
• Org Key
• App ID
• API Secret Key

The Hostname URL value is determined by your Carbon Black Dashboard URL, excluding "https://" from the address, which you can find in this table.

To gather your credentials in Carbon Black, do the following:

1. In Carbon Black Endpoint Standard, navigate to Dashboard > General.
2. Find and copy the Org Key, which is located below the Org ID.
   Note: Org ID is different from Org Key and will not work as a credential in the Blumira Cloud Connector.
3. Navigate to Dashboard > Settings > API Access.
4. Click Access Levels on the top left.
5. Click Add Access Levels on the top right.
6. In the Edit Access Level window, type a name and a description, then click the Read check box in the row for each of these seven permissions:
   • Alerts
     • Tags (org.alerts.tags)
     • ThreatMetadata (org.xdr.metadata)
     • Notes (org.alerts.notes)
     • ThreatHunt (org.mdr.threathunts)
     • General information (org.alerts)
   • Audit Logs (org.audits)
   • Custom Detections (org.watchlists)
     
     
     
     
7. Click Save.
8. In the API Access window, click Add API Key.
9. In the Name box, type a name for the API Key.
10. In the Access level type box, select Custom from the dropdown list.
11. In the Custom Access Level box, select the Access Level you created in previous steps.
12. Click Save.
    
    
    
    
13. In the window that appears, copy and save the Secret ID and the Secret Key to use in the Cloud Connector.

Configuring the Blumira Cloud Connector

Cloud Connectors automate the configuration of your integrations without requiring you to use a sensor. After you obtain your integration's configuration parameters, you can then enable Blumira to collect your logs.

To configure the Blumira Cloud Connector:

1. In the Blumira app, navigate to Settings > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, click the connector you want to add.
4. In the Cloud Connector Name box, type a name to help identify the specific integration. 
5. Enter the credentials that you collected in the previous steps.
6. Click Connect.

Tip: If you receive an error when attempting to connect, ensure your access level permissions are correct in Carbon Black and that you are using the proper URL.