> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Carbon Black EDR

> Connect ThreatAware to Carbon Black EDR to monitor endpoint security and threat data

## Overview

The Carbon Black EDR integration enables ThreatAware to collect read-only data from your Carbon Black EDR console, providing visibility into endpoint security status, alerts, and device information.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Carbon Black EDR Administrator account
</Info>

## Data collected

The Carbon Black EDR integration provides:

* Endpoint inventory
* Security alerts
* Threat detection data
* Device compliance status

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Security" icon="shield-halved">
    Monitor endpoint protection status across your infrastructure
  </Card>

  <Card title="Alert Management" icon="clipboard-check">
    Track and correlate security alerts from endpoints
  </Card>

  <Card title="Threat Detection" icon="eye">
    Detect and respond to endpoint threats
  </Card>

  <Card title="Compliance Reporting" icon="file-contract">
    Generate reports on endpoint security coverage
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Carbon Black EDR Console">
    Access your [Carbon Black EDR Console](https://console.carbonblack.com) with administrator credentials.
  </Step>

  <Step title="Create API Access Key">
    In the Carbon Black EDR console:

    * Navigate to **Settings** > **API Keys**
    * Click **Add API Key**
    * Select **Custom** for ThreatAware integration
    * Set permissions to **Read** access on:
      * Device data
      * Alert data
      * Any other necessary resources
    * Note the **API ID** and **API Secret Key** generated

    <Warning>
      Only grant read permissions. ThreatAware operates on a read-only basis and does not require write access.
    </Warning>
  </Step>

  <Step title="Retrieve Server URL">
    Make note of the **Server URL** for your Carbon Black EDR instance. This is typically displayed in your console URL.

    Example: `https://your-carbonblack-url.com`
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Navigate to **Settings** > **Integrations**
    * Search for and select **Carbon Black EDR**
    * Enter the required credentials:
      * **Server URL**: Your Carbon Black EDR instance URL
      * **API ID**: The API ID from step 2
      * **API Secret Key**: The secret key for API authentication
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working:

    * Check that the **Integration Status** shows as **Active**
    * Confirm that endpoint data is appearing in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API ID" icon="key">
    **Field Name**: Carbon Black EDR API ID
    **Type**: String
    **Description**: The identifier for the Carbon Black EDR API key

    This ID is displayed when you create the API key in Carbon Black EDR settings.
  </Accordion>

  <Accordion title="API Secret Key" icon="lock">
    **Field Name**: Carbon Black EDR API Secret Key
    **Type**: Password (encrypted)
    **Description**: The secret key associated with the API ID

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="Server URL" icon="server">
    **Field Name**: Carbon Black EDR Server URL
    **Type**: String
    **Description**: The URL of your Carbon Black EDR instance

    **Format**: `https://your-carbonblack-url.com`
    **Example**: `https://cbr.my-company.com` or `https://edr.carbonblack.io`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Carbon Black EDR integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for the initial data sync
   * Search for a known endpoint in ThreatAware
   * Confirm Carbon Black EDR data is visible

3. **Test Queries**
   * Create a test query to filter endpoints from Carbon Black EDR
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Permission Errors" icon="triangle-exclamation">
    **Symptoms**: Integration connects but fails to retrieve data

    **Solutions**:

    * Verify the API key has **Read** permissions for device and alert data
    * Review the [Carbon Black EDR API Documentation](https://developer.carbonblack.com) for required permissions
    * Ensure the API key has not been restricted to specific devices or groups
    * Check that your administrator account has full API permission delegation enabled
  </Accordion>

  <Accordion title="URL or API Key Issues" icon="ban">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Double-check the **Server URL** for accuracy (no extra spaces or typos)
    * Verify the **API ID** and **API Secret Key** are exactly as displayed in Carbon Black EDR
    * Ensure the API key is active and has not expired
    * Confirm the API key has not been revoked in the Carbon Black EDR console
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **Server URL** is correct and accessible from ThreatAware
    * Check firewall rules allow outbound HTTPS (443) to your Carbon Black EDR instance
    * Test the URL in a browser to ensure it's reachable
    * Confirm your Carbon Black EDR console is online and responsive
  </Accordion>

  <Accordion title="No Data After 10 Minutes" icon="database">
    **Symptoms**: Integration shows active but no endpoint data appears

    **Solutions**:

    * Verify you have endpoints registered in Carbon Black EDR
    * Check the API key has access to device data
    * Review Carbon Black EDR API logs for any errors
    * Wait up to 15 minutes for the initial sync to complete
    * Contact ThreatAware support if data does not appear after 30 minutes
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Carbon Black API Documentation" icon="book" href="https://developer.carbonblack.com">
    Official Carbon Black API documentation for detailed permissions and configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API key specifically for ThreatAware
  * Document credentials in your organisation's password manager
  * Rotate API keys annually or per your security policy
  * Monitor API usage in Carbon Black EDR regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read permissions to the API key
  * Limit API key scope to necessary resources
  * Review Carbon Black EDR audit logs periodically to monitor API access
  * Follow your organisation's least privilege principles
</Tip>