Integrate Internal Security with CarbonBlack

In this article:

We are currently building support for this integration. Contact your SecurityScorecard sales engineer for more information.

Take the following integration steps to provide ISS Internal Security with necessary information to communicate with your CarbonBlack endpoint security device.

When integrated, Internal Security extracts the following information from CarbonBlack:

• List of unknown apps
• All recommendations
• Threat alerts
• Device list

Prepare for your integration

Before configuring the integration do the following:

1. Install Internal Security from Integrate360°: Marketplace. See ISS Internal Security module for guidance. 
2. Make sure you have Super Admin permissions in CarbonBlack or access to someone who does.

The Internal Security integration requires the following configuration values:

Note: Contact your internal Support or Engineering team if you are unable to provide the information required for this integration.

Step 1: Generate an API key

Create a key that will provide Internal Security with read-only access to CarbonBlack data:

1. Log into CarbonBlack.
2. Select API Access under Settings in the left pane.
   
   
3. In API Access, select the API Keys tab.
4. Click Add API Key.
   
   
   
   
5. Enter a name for the key and select the API access level. Then click Save.
   
   
   
   
6. Copy the following information, which you will need in the next step.

• • The newly generated key that appears in the API Access table
  • The Organization Key, which appears above the table
  • The base product URL which appears in your browser when you log into CarbonBlack
    
    

Step 2: Find your base product URL

See CarbonBlack's documentation for guidance on finding the URL. You will need it in the next step.

Step 3: Add a CarbonBlack integration in Internal Security

Provide Internal Security with the required information for communicating with CarbonBlack:

1. In your Scorecard header, select the Internal Security tab. Then, select Internal Security again.
   
   
   
   
2. On the Internal Security page Add integrations.
   
   
   
   
3. On the Set up integrations page, click Add integration.
   
   
   
   
4. Select CarbonBlack from the drop-down list.
   
   
   
   
5. Enter the required information from the preceding step and then click Save Configuration:
• The API key
• The organization key
• The base product URL for the API

  Note: Make sure to precede the URL with http:// or https://, depending on which protocol applies. Also, It is only necessary to specify the port number for the base product URL if it is not 80 or 443.

  

Your new integration appears in a table on the Internal Security page.

Note: Data for this integration will be available when we finish building support for it. See a list of the Internal Security product integrations we currently support.

Additional documentation and resources

• API guidance

• Installed library: carbon-black-cloud-sdk