VMware Carbon Black Cloud Endpoint Standard and Enterprise EDR Integration Guide

integrations endpoints vmware carbon black edr

The following applies to:

• VMware Carbon Black Cloud Endpoint Standard
• VMware Carbon Black Cloud Enterprise EDR

In order to integrate your VMware Carbon Black Cloud subscription you must configure a Secureworks user account in the Carbon Black domain. The details of this account are captured in the Integration page and allow for integration of Enterprise EDR events into Secureworks® Taegis™ XDR.

To integrate XDR with VMware Carbon Black Cloud you need four pieces of information from the Carbon Black Enterprise EDR Dashboard:

Data Provided from Integration ⫘

	Alerts	Auth	DNS	File Collection	HTTP	NIDS	Netflow	Process	File Modification	API Call	Registry	Scriptblock	Management	Persistence	Thread Injection
VMware Carbon Black Cloud Endpoint™ Standard	✓		✓				✓	✓	✓	✓	✓	✓			✓
VMware Carbon Black Cloud Enterprise EDR	✓		✓				✓	✓	✓	✓	✓	✓			✓

The Environment ⫘

To figure out which environment to select when configuring Carbon Black Cloud:

1. Log in to your Carbon Black Dashboard with a user which has the Super Admin role. Note the first part of the URL:

Carbon Black Cloud Dashboard URL

2. Match that URL with the environments listed in the following table:

Carbon Black Dashboard URL	XDR Environment for Carbon Black
https://defense-prod05.conferdeploy.net/	prod05
https://dashboard.confer.net/	prod01
https://defense.conferdeploy.net/	prod02

So, for example, if your URL starts with https://defense-prod05.conferdeploy.net/, then you should select prod05 as your environment.

The Org Key ⫘

To find the Org Key from your Carbon Black Dashboard:

3. In the Carbon Black Dashboard, navigate to Settings→API Access and securely copy the ORG KEY from the API Keys tab.

Carbon Black Settings→API Access

The API ID and API Secret Key ⫘

4. Navigate to the Access Levels tab and select + Add Access Level button

Carbon Black Add Access Level

5. Configure the following settings:

• Name: Secureworks API Access.
• Description: Secureworks Access Levels needed for TDR Integration.
• Device, Quarantine: Select Execute.
• Device, General Information: Select Read.
• Data Forwarder, Settings: Select Create, Read, Update, Delete.

6. Select the Save button when complete.

Carbon Black Access Level Permissions

7. Navigate back to the API Keys tab and select the + Add API Key button

Carbon Black Add API Key

8. Configure the following settings:

• Name: Secureworks API Integration Access
• Access Level type: Custom
• Custom Access Level: Secureworks API Access

9. Select the Save button when complete.

API Key Creation

10. From the same API Keys tab, view and record (securely) the API ID and API Secret Key using the dropdown menu on the right under Actions.

API Credentials

11. Now that you have recorded the API ID and API Secret Key, complete the integration in XDR by Adding a Carbon Black Cloud Collector.