Skip to main content

Integrate Internal Security with CarbonBlack

Mark Glinski
  • Updated

In this article:

    Take the following integration steps to provide ISS Internal Security with necessary information to communicate with your CarbonBlack endpoint security device.

    When integrated, Internal Security extracts the following information from CarbonBlack:

    • List of unknown apps
    • All recommendations
    • Threat alerts
    • Device list

    Prepare for your integration

    Before configuring the integration do the following:

    1. Install Internal Security from Integrate360°: Marketplace. See ISS Internal Security module for guidance. 
    2. Make sure you have Super Admin permissions in CarbonBlack or access to someone who does.

    The Internal Security integration requires the following configuration values:

    Setting Description
    API key A token provides permission to perform the GET request
    Organization key

    An identifier that the product assigns to your organization 
    Base product URL

    The URL for the deployed product.
    Example: https://defense-prod05.conferdeploy.net/
    Note: Contact your internal Support or Engineering team if you are unable to provide the information required for this integration.

    Step 1: Generate an API key

    Create a key that will provide Internal Security with read-only access to CarbonBlack data:

    1. Log into CarbonBlack.
    2. Select API Access under Settings in the left pane.

      iss-carbonblack-dashboard.png
    3. In API Access, select the API Keys tab.
    4. Click Add API Key.

      iss-carbonblack-add-key-button.png

    5. Enter a name for the key and select the API access level. Then click Save.

      iss-carbonblack-api-key-details.png

    6. Copy the following information, which you will need in the next step.
      • The newly generated key that appears in the API Access table
      • The Organization Key, which appears above the table
      • The base product URL which appears in your browser when you log into CarbonBlack

        iss-carbon-black-copy-keys.png

    Step 2: Find your base product URL

    See CarbonBlack's documentation for guidance on finding the URL. You will need it in the next step.

    Step 3: Add a CarbonBlack integration in Internal Security

    Provide Internal Security with the required information for communicating with CarbonBlack:

    1. In your Scorecard header, select the Internal Security tab. Then, select Internal Security again.

      iss-iss-internal-security-tab.png

    2. On the Internal Security page Add integrations.

      iss-internal-security-main-page-add_integrations.png

    3. On the Set up integrations page, click Add integration.

      iss-integrations-add-new.png

    4. Select CarbonBlack from the drop-down list.

      iss-integrations-select-carbonblack.png

    5. Enter the required information from the preceding step and then click Save Configuration:
      • The API key
      • The organization key
      • The base product URL for the API
        Note: Make sure to precede the URL with http:// or https://, depending on which protocol applies. Also, It is only necessary to specify the port number for the base product URL if it is not 80 or 443.
        iss-carbonblack-is-integration-settings.png

    Your new integration appears in a table on the Internal Security page. Start viewing your Internal Security score and findings within 24 hours.

    iss-internal-security-main-page-carbonblack-added.png

    Note: Internal Security starts to provide data within 24 hours for each new integration as it syncs with SecurityScorecard's scanning and scoring cycles. 

    Additional documentation and resources

    Related articles