VMware Carbon Black Cloud — Integration Setup
Prerequisites
- Carbon Black Cloud tenant (Endpoint Standard, Advanced, Enterprise EDR, or MDR)
- Super Admin or Sysadmin access to the Carbon Black Cloud console
- CMDash Essentials tier or above
Step 1: Create an API Key
- Log in to the Carbon Black Cloud console.
- Go to Settings → API Access → API Keys.
- Click Add API Key.
- Name:
CMDash Integration. - Access Level Type: Custom → choose a role with at least:
org.alerts.READorg.devices.READ
- Click Save and record the API ID and API Secret Key.
- Note your Org Key (Settings → API Access → shows as
ORG_KEY).
Step 2: Connect in CMDash
- Navigate to Integrations in your CMDash dashboard.
- Find VMware Carbon Black and click Connect.
- Enter:
- Base URL (e.g.,
https://defense-prod05.conferdeploy.net) - Org Key
- API ID
- API Secret Key (stored encrypted; only used for signing requests)
- Base URL (e.g.,
- Click Save & Test Connection.
What Syncs
| Data Type | API | Sync Frequency |
|---|---|---|
| Devices (endpoints) | POST /appservices/v6/orgs/{org}/devices/_search | Every 4 hours by default |
| Alerts (incidents) | POST /api/alerts/v7/orgs/{org}/alerts/_search | Every 4 hours by default |
Required Permissions
org.devices.READ— device inventoryorg.alerts.READ— alert stream
CMDash performs only read operations.
Troubleshooting
- HTTP 401: API ID and Secret must be provided together as
<secret>/<id>in theX-Auth-Tokenheader. Re-check they were not swapped during paste. - HTTP 403 on
alerts/_search: the custom role is missingorg.alerts.READ. Update the role in Carbon Black and wait ~1 minute for permissions to propagate. - Partial device results: the devices search paginates at 500 per page. Tenants over 10 000 devices are capped at 10 000 per sync to bound runtime; raise the cap by setting
syncLimiton the integration config if needed.