Integrating VMware Carbon Black Response With Blumira

While Carbon Black Response (CBR) does have the ability to send syslog from the local appliance, the API is the best method for data coverage out of the application. Once you have a Sensor running (see Adding a sensor in the Blumira app) with the Logger module, you can proceed with CBR Module setup.

Adding API User to Carbon Black Response

To connect to the CBR API and get alerts/events that occur based off of the managed Watchlists, Blumira requires two accounts to be provisioned. Blumira only requires the API Keys, Blumira does not require credentials to be directly shared.

  1. Read-Write User, recommended name blumira_rw
    Access Needs: Watchlist Reading/Writing/Modification
    Reason: To create, update, and manage Watchlists based off of Blumira guidance and experience
  2. Read-Only User, recommended name blumira_ro
    Access Needs: Read Only
    Reason: To connect to the CBR API and get alerts/events that occur based off of the managed Watchlists

Once these users are created, go to their profile and API Token area to gather the API Token that you will need in later steps.
Carbon Black API Token

Adding Data Source

1. If the Sensor is already created, select the far right edit button and click View Detail.
Carbon Black Country

2. Once the flyout for your Sensor opens, click Add a module, which will then open the Module selection screen.  Select the latest version of the Carbon Black Response Module, the current version as of last update of this article was 1.0.0.
Carbon Black Module 1.0
3. After selecting the latest version, you will be presented with a form to enter the API Host, Read/write API Key, and Read-only API Key.  From the previous steps, you should have these three pieces of information, input them into their respective fields and click Create.  API Host should be the address of your CBR server, it must be accessible over 443 from the Sensor.

Carbon Black Module Keys

4. All set! Blumira will deploy the module with the defined details and poll the CBR API regularly to look for events that occur within the environment.