Skip to main content

​
Overview

The Carbon Black EDR integration enables ThreatAware to collect read-only data from your Carbon Black EDR console, providing visibility into endpoint security status, alerts, and device information.
Connection Method: API Setup Time: 15 minutes Access Required: Carbon Black EDR Administrator account

​
Data collected

The Carbon Black EDR integration provides:
  • Endpoint inventory
  • Security alerts
  • Threat detection data
  • Device compliance status

​
Use cases

Endpoint Security

Monitor endpoint protection status across your infrastructure

Alert Management

Track and correlate security alerts from endpoints

Threat Detection

Detect and respond to endpoint threats

Compliance Reporting

Generate reports on endpoint security coverage

​
Setup instructions

1

Log in to Carbon Black EDR Console

Access your Carbon Black EDR Console with administrator credentials.
2

Create API Access Key

In the Carbon Black EDR console:
  • Navigate to Settings > API Keys
  • Click Add API Key
  • Select Custom for ThreatAware integration
  • Set permissions to Read access on:
    • Device data
    • Alert data
    • Any other necessary resources
  • Note the API ID and API Secret Key generated
Only grant read permissions. ThreatAware operates on a read-only basis and does not require write access.
3

Retrieve Server URL

Make note of the Server URL for your Carbon Black EDR instance. This is typically displayed in your console URL.Example: https://your-carbonblack-url.com
4

Configure in ThreatAware

Complete the integration setup in ThreatAware:
  • Navigate to Settings > Integrations
  • Search for and select Carbon Black EDR
  • Enter the required credentials:
    • Server URL: Your Carbon Black EDR instance URL
    • API ID: The API ID from step 2
    • API Secret Key: The secret key for API authentication
  • Click Connect to establish the integration
5

Verify Connection

After connecting, verify the integration is working:
  • Check that the Integration Status shows as Active
  • Confirm that endpoint data is appearing in ThreatAware

​
Required credentials

Field Name: Carbon Black EDR API ID Type: String Description: The identifier for the Carbon Black EDR API keyThis ID is displayed when you create the API key in Carbon Black EDR settings.
Field Name: Carbon Black EDR API Secret Key Type: Password (encrypted) Description: The secret key associated with the API ID
Store this credential securely in your organisation’s password manager for future reference.
Field Name: Carbon Black EDR Server URL Type: String Description: The URL of your Carbon Black EDR instanceFormat: https://your-carbonblack-url.com Example: https://cbr.my-company.com or https://edr.carbonblack.io

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the Carbon Black EDR integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 5-10 minutes for the initial data sync
    • Search for a known endpoint in ThreatAware
    • Confirm Carbon Black EDR data is visible
  3. Test Queries
    • Create a test query to filter endpoints from Carbon Black EDR
    • Verify the data matches your expectations

​
Troubleshooting

Symptoms: Integration connects but fails to retrieve dataSolutions:
  • Verify the API key has Read permissions for device and alert data
  • Review the Carbon Black EDR API Documentation for required permissions
  • Ensure the API key has not been restricted to specific devices or groups
  • Check that your administrator account has full API permission delegation enabled
Symptoms: Integration status shows authentication failureSolutions:
  • Double-check the Server URL for accuracy (no extra spaces or typos)
  • Verify the API ID and API Secret Key are exactly as displayed in Carbon Black EDR
  • Ensure the API key is active and has not expired
  • Confirm the API key has not been revoked in the Carbon Black EDR console
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Server URL is correct and accessible from ThreatAware
  • Check firewall rules allow outbound HTTPS (443) to your Carbon Black EDR instance
  • Test the URL in a browser to ensure it’s reachable
  • Confirm your Carbon Black EDR console is online and responsive
Symptoms: Integration shows active but no endpoint data appearsSolutions:
  • Verify you have endpoints registered in Carbon Black EDR
  • Check the API key has access to device data
  • Review Carbon Black EDR API logs for any errors
  • Wait up to 15 minutes for the initial sync to complete
  • Contact ThreatAware support if data does not appear after 30 minutes

​
Additional resources

Carbon Black API Documentation

Official Carbon Black API documentation for detailed permissions and configuration

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated API key specifically for ThreatAware
  • Document credentials in your organisation’s password manager
  • Rotate API keys annually or per your security policy
  • Monitor API usage in Carbon Black EDR regularly
Security Considerations
  • Only grant read permissions to the API key
  • Limit API key scope to necessary resources
  • Review Carbon Black EDR audit logs periodically to monitor API access
  • Follow your organisation’s least privilege principles