| 1 | # [CarbonBlack Integration](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/latest/alerts-api/) |
| 2 | |
| 3 | CarbonBlack is a cloud-based endpoint security platform that provides continuous monitoring and threat detection for endpoints. This integration allows you to ingest CarbonBlack alerts into the SOCFortress SIEM stack. |
| 4 | |
| 5 | ## Introduction |
| 6 | |
| 7 | The CarbonBlack API follows a RESTful pattern. Requests are made via resource-oriented URLs as described in this document and API responses are formatted as JSON data and ingested into the SOCFortress SIEM stack. |
| 8 | |
| 9 | ## Use Cases |
| 10 | |
| 11 | - Poll for Alerts to ingest into a SIEM |
| 12 | |
| 13 | ## Requirements |
| 14 | |
| 15 | - Any Carbon Black Cloud product |
| 16 | - Some Alert Types are only generated by specific products |
| 17 | |
| 18 | # Steps |
| 19 | |
| 20 | ## Create a custom access level. |
| 21 | |
| 22 | 1. Sign in to the VMware Carbon Black Cloud UI console. |
| 23 | 2. In the navigation menu, click **Settings > API Access**. |
| 24 | 3. On the **API ACCESS** page, in the **Access Levels** tab, click **Add Access Level**. |
| 25 | 4. In the dialog, configure these settings: |
| 26 | - **Name** — Enter a memorable name. |
| 27 | - **Description** — Enter a description for the API key. |
| 28 | - **Permissions table** — In the Alerts row, select **READ** for the General information permission. |
| 29 | - Note: This automatically selects **Custom** in the **Copy permissions from** list. |
| 30 | 5. Click **Save**. |
| 31 | |
| 32 | ## Configure a new API key |
| 33 | |
| 34 | 1. In the navigation menu, click **Settings > API Access**. |
| 35 | 2. On the **API ACCESS** page, in the **API Keys** tab, click **Add API Key**. |
| 36 | 3. In the dialog, configure these settings: |
| 37 | - **Name** — Enter a unique name for the API key. For example, "CoPilot API." |
| 38 | - **Access Level type** — Select **Custom**. |
| 39 | - **Custom Access Level** — Select the access level you created in **Create a custom access level**. |
| 40 | 4. Click **Save**. |
| 41 | 5. Copy the **API ID** and **API Secret Key** values, and then save them in a safe, encrypted location. You will provide them to CoPilot later. |
| 42 | 6. On the **API Keys** tab, copy the **ORG Key** and **ORG ID** values, and then save them in a safe, encrypted location. You will provide them to CoPilot later. |
| 43 | 7. In the URL of your VMware Carbon Black Cloud console, copy, and then save the hostname component of the base API URL for your environment. For example, `https://defense.conferdeploy.net`. You will provide this to CoPilot later. |
| 44 | > Tip: See [Constructing your Request](https://developer.carbonblack.com/reference/carbon-black-cloud/authentication/#constructing-your-request) for more information. |