VMware Carbon Black Cloud

VMware Carbon Black Cloud (formerly Carbon Black Defense). Pulls alerts and audit log entries via API key authentication. Supports host isolation and hash banning via agent capabilities.

• Connector id: carbon_black
• Category: edr

Configuration

Field	Label	Type	Required	Default	Notes
region	Region	select	yes	—	CBC region your tenant is hosted in. The wrong region returns 401 rather than 404, so this can't be auto-detected. · one of: us_east, us_west, eu, uk, au, apac
org_key	Org Key	string	yes	—	Found in CBC console under Settings → API Access → API Keys (the column labeled 'Org Key').
api_id	API ID	string	yes	—	The 'API ID' half of the credential pair.
api_secret	API Secret Key	secret	yes	—	encrypted at rest · The long secret half of the credential pair.

Credential handling

api_secret is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API — a read of the saved connector shows the field as set, not its contents. See credential vault.

Setup

1. In the console, go to Connectors → Add connector and pick VMware Carbon Black Cloud.
2. Fill in the fields above and run Test connection. The test is read-only and does not save anything.
3. Save. Polling starts on a jittered schedule within about a minute; the connector row shows last_sync once the first poll completes.

If last_sync stays empty

The first poll is the honest signal that the credential works. A connector that saves cleanly and never syncs usually means the credential lacks a scope the vendor requires for reads — check the connectors service log for the vendor's own error, which is passed through verbatim rather than summarised.

Vendor-specific setup notes go here: which console page issues the credential, which scopes to grant, rate limits, and anything the schema cannot express. This section is preserved when the page is regenerated.