VMware Carbon Black EDR Response Integration via API

Purpose

This guide explains how to connect Logsign to VMware Carbon Black EDR (formerly known as Cb Response) so that Logsign Incidents and Alarms can query and act on Carbon Black EDR data directly from the Logsign console. This is a Response/Action integration, configured under Settings > Integrations > Responses, not a log collection poller. Once a device is configured, analysts can trigger any of the available methods manually from an incident, or reference them in automation rules, to pull process and binary details, search alerts, manage the hash blacklist and watchlists, look up sensor status, and run interactive Live Response sessions on an endpoint.

Carbon Black EDR is normally deployed on premises or as a single-tenant hosted instance, so this integration talks to your own Carbon Black EDR server URL rather than a shared cloud endpoint.

Prerequisites

You need the following before configuring the integration:

• A reachable Carbon Black EDR server URL (on-premises console or your hosted EDR instance) that Logsign can connect to over HTTPS.
• A Carbon Black EDR user account with an API token, created according to the least-privilege guidance in Step 1 below. Do not use a Global Administrator account for this integration unless your organization has a specific reason to.
• Network access from the Logsign server to the Carbon Black EDR server on the HTTPS port used by its console (typically 443).
• If your Carbon Black EDR server uses a certificate that is not trusted by a public certificate authority (common in on-premises deployments with self-signed certificates), decide in advance whether you want Logsign to skip TLS certificate validation for this connection. See the note under Step 2 about the Skip Certificate Validation field, since its default behavior is not what most security teams expect.

Step 1: Generate an API token in Carbon Black EDR

Carbon Black EDR issues one API token per user account, and that token inherits every permission assigned to the user it belongs to. There is no separate concept of an API-only service account with its own scoped permission set the way some modern SaaS products offer; the token is only as restricted as the underlying user's role. Because of this, the most important decision in this step is which user you generate the token for, not the token itself.

Carbon Black EDR's role model is Team-based. Each user is assigned to one or more Teams, and each Team grants one of four base roles over a set of sensor groups: Administrator, Analyst, Viewer, or No Access. Administrators can manage users, teams, and server settings in addition to endpoint data; Viewers can read endpoint and alert data but cannot use Live Response, sensor isolation, or hash banning; Analysts sit in between and can perform response actions, but only after being granted specific enhanced permissions on top of the base Analyst role.

For this integration, create (or reuse) a dedicated user with the Analyst role scoped to the sensor groups you want Logsign to act on, and grant it only the enhanced permissions the methods you plan to use actually require:

Do not grant Isolating sensors or Uninstalling sensors permissions for this integration. Neither capability is exposed by any method in this integration (see Notes and Limits below), so granting them only widens the account's blast radius without giving Logsign anything to use. All read-only methods (process search, binary search, alert search, watchlist, blacklist, endpoint and ingress whitelist lookups) work with the base Analyst or even Viewer role and do not need any enhanced permission.

Once the user and its role are set up, generate the token from that account:

1. Log in to the Carbon Black EDR console as the user you prepared above.
2. Click the username in the upper right corner and select My Profile (or Profile info, depending on your EDR version).
3. Click API Token in the left-hand menu.
4. If no token is shown, click Reset to generate one. If a token already exists and you want to rotate it, clicking Reset invalidates the old token immediately, so update any other integration using it at the same time.
5. Copy the token value. Carbon Black EDR does not mask or re-display it later beyond this screen, so store it securely (for example in the Logsign configuration you set up in Step 2) before navigating away.

The exact menu wording (My Profile vs. Profile info, API Token vs. API Key) varies slightly between Carbon Black EDR versions; the underlying flow (username menu > profile > API token > Reset) has been consistent across the versions checked in Broadcom's published documentation as of July 2026.

Step 2: Configure the integration in Logsign

In the Logsign console, go to Settings > Integrations > Responses, search for VMware Carbon Black EDR, click Configure, then +Device to add a new instance. Fill in the following fields:

Click Create to save the device. You can use the built-in connection test (which internally calls the Get Watchlist method) to confirm the Server Url and Api Key are correct before relying on the device in an automation rule.

Available Methods

The methods below are grouped by what they do. Each one can be triggered manually from an Incident or wired into an automation rule once the device above is configured. Field names shown are the exact argument names used by the method.

Process investigation

Process Search runs a Carbon Black EDR process search query and returns matching process executions.

Process Summary returns a process's parent, siblings, and children for a given process and segment ID.

Process Segment Details lists the recorded segments of a process, with per-segment event counts (file, registry, module, network, and cross-process activity).

Process Event Details returns the detailed event stream (registry modifications, file modifications, module loads) for a process segment.

Process Preview returns a condensed summary view of a process segment, optionally filtered by a search term.

Collective Defense Cloud Query queries Carbon Black's threat intelligence feeds for a process segment and returns any matching IOC hits.

Binary investigation

Binary Search searches Carbon Black EDR's binary (executable) index.

Retrieve Binary Metadata returns full metadata (digital signature status, file version, publisher, observed paths) for a single binary.

Alerts

Search Alerts searches Carbon Black EDR's alert index (watchlist hits, threat intel matches).

Hash blocking (banning)

Get Blacklist returns the current list of banned (blocked) MD5 hashes and their ban history. It takes no arguments.

Block Hash adds an MD5 hash to the blacklist, preventing it from executing on sensors going forward.

Note: the underlying method reads both md5hash and text from the request, but at the time of writing the Block Hash method's argument schema is not populated, so the Logsign UI may not render input fields for them automatically. If you do not see fields for md5hash and text when configuring a Block Hash action, contact Logsign support before relying on this method in production; do not assume it silently works with an empty hash.

Watchlists

Get Watchlist returns the list of configured watchlists (saved searches that generate alerts on new matches). It takes no arguments. This is also the method Logsign calls internally when you use the connection test on this device.

Endpoints (sensors)

Get Endpoint By Id returns full status for a single sensor: health, uptime, OS, last check-in time, and current network isolation state.

Get Endpoints returns the same status fields for all sensors matching the given filters.

Both endpoint methods return the sensor's is_isolating and network_isolation_enabled fields as read-only status. This integration does not include a method to trigger or lift network isolation; see Notes and Limits.

Ingress event filtering (whitelists)

Get Ingress Whitelist By Id returns a single ingress filter definition (path or command-line filters that suppress event collection for matching activity).

Get Ingress Whitelists returns all configured ingress filter entries. It takes no arguments.

Live Response

These four methods drive Carbon Black EDR's Live Response feature, which opens an interactive remote session on a sensor and runs commands on it. They require the Live Response enhanced permission on the API user (see Step 1).

List Live Response Sessions returns all Live Response sessions and their status (pending, active, or closed). It takes no arguments.

Start Live Response Sessions opens a new Live Response session against a sensor.

After requesting the session, Logsign waits approximately 3 seconds before fetching the session status once and returning it. If the sensor takes longer than that to accept the session, the returned status may still show pending rather than active; use List Live Response Sessions afterward to confirm the final state.

Execute Command With Live Response runs a single Live Response command inside an existing session.

As with session start, Logsign waits approximately 3 seconds after submitting the command before fetching its result once. Commands that take longer than that to complete may be returned with a non-final completion status.

Close Live Response Session closes an active session.

Notes and Limits

• This integration does not include a method to isolate or unisolate a sensor's network connection, even though Carbon Black EDR itself supports this action and exposes is_isolating and network_isolation_enabled as read-only fields on Get Endpoint By Id and Get Endpoints. If your use case depends on triggering network isolation from Logsign, that capability is not currently available through this integration and would need to be requested as a product enhancement.
• Authentication is a single per-user API token sent as the X-Auth-Token header, not OAuth2. There is no token expiry or refresh flow to manage; the token is valid until it is manually reset in the Carbon Black EDR console.
• Insecure Skip Verify defaults to enabled in the current configuration schema, which skips TLS certificate validation. Review this setting deliberately for every device rather than accepting the default, especially for internet-reachable Carbon Black EDR servers.
• The Block Hash method's argument schema does not currently declare its md5hash and text parameters, even though the underlying integration code reads and uses both. Confirm with Logsign support that these fields are exposed in your console version before relying on Block Hash for automated response.
• Start Live Response Sessions and Execute Command With Live Response each include a fixed roughly 3-second wait before checking the result once. For slower sensors or longer-running commands, the immediate response may show a non-final status (pending/incomplete); follow up with List Live Response Sessions or re-run the check if needed.
• Carbon Black EDR's REST API does not publish a documented per-account rate limit for this on-premises product the way its cloud-hosted counterpart does; if you see HTTP 429 responses, treat it as a signal to reduce request frequency rather than a fixed quota you can plan around precisely. This has not been independently verified against a live Logsign deployment.
• Carbon Black EDR is typically self-hosted or single-tenant hosted, so there is no fixed list of regional API base URLs to choose from. The Server Url field always points at your own instance.

Troubleshooting