Carbon Black CB Response

This document applies to Classic/Legacy Integrations. You may continue to use these integration configurations. While no active development is happening for these integrations, we continue to provide Classic/Legacy Integrations in the product. You do not have to move to MSI Integrations. If your support engineer or TSC recommends or you choose to move to MSI Integrations, you can take advantage of the latest features and functionality. For more information, see the MSI Integration documentation in the Integrations Overview.

This integration is remote capable.

Generate an API key for CB Response

The CB Response integration supports V1 and V2 of the Carbon Black API.

API tokens are tied to user accounts and inherit the user's privileges. When capturing the API key, use an account with the necessary privileges.

Read permissions are required, at minimum.

To generate an API key

Access your profile by logging into the Carbon Black server, clicking your name, and choosing Profile.
Click the API Token link and copy your API token from the text box.
Each user receives their own unique API token. This token has the same privileges that are assigned to your name. The token does not expire.

Update the Validation Platform

Prerequisites

Information to gather before you start:

API key for CB Response.
IP address or FQDN used to access CB Response.

Configuration

To add the Carbon Black CB Response integration

Go to Settings > Integrations.
Click Add Integration > Carbon Black CB Response.
Enter the Host and API Key information.
Select the API Version.
Expand Advanced options and update the information if necessary.
Click Submit.

Carbon Black CB Response Integration

Set up Proxy Assignment

If all outbound connections go through a proxy, you may want to set up a proxy definition and assignment for your integration. For information on setting up your proxy rules, see Proxy Rules.

Verify Connectivity

To verify connectivity to the CB Response host

Click Test to verify that:

The Director can communicate with the CB Response IP address on the port specified.
The API key is working and has the necessary privileges.