---
title: Vmware Carbon Black Edr
slug: connectors/vmware-carbon-black-edr
docTags: 
createdAt: 2026-06-09T16:30:00.311Z
---

The VMWare Carbon Black EDR connector facilitates seamless integration with the Carbon Black EDR platform, enabling automated threat detection and response actions.

VMWare Carbon Black EDR is a leading endpoint detection and response platform that provides comprehensive threat hunting and incident response capabilities. This connector enables Swimlane Turbine users to automate key security operations tasks such as retrieving binary details, isolating or unblocking files, fetching alerts, and managing sensors. By integrating with VMWare Carbon Black EDR, users can streamline their security workflows, rapidly respond to threats, and enhance their overall security posture without the need for manual intervention.

## Prerequisites

To effectively utilize the VMWare Carbon Black EDR connector with Swimlane Turbine, ensure you have the following prerequisites:

- API Key Authentication with the following parameters:
  - URL: The endpoint URL for the VMWare Carbon Black EDR API.
  - API Key: Your personal API key provided by VMWare Carbon Black EDR for secure access.

## Capabilities

This Connector allows security operators to manage alerts, processes, binaries and hosts on devices.

## Asset Setup

This section provides instructions for obtaining information for the Swimlane asset.

### Obtaining an API Token

1. Log into your Carbon Black server. From the top right corner, click your name and then select **My Profile**.
2. From the top left corner of your profile, click **API Token**.
3. If you have not previously generated an API token, generate it now. Copy the token into the asset in Swimlane.

**Note:** You may reset your token in order to generate a new one at any time.

### Permissions

The user to whom this token is assigned must have permissions for basic analyst actions, isolating hosts, and managing binaries.

### Limitations

Some API documentation query options show lowercase examples but they must be capitalized.
This may happen with other options.

For example, the Get Alerts query is mentioned in the Carbon Black documentation as `status:resolved` but must be `status:Resolved` in order to filter properly.

## Documentation

- [API Documentation](https://developer.carbonblack.com/reference/enterprise-response/6.3/rest-api/)
- [Quick Start Guide](https://developer.carbonblack.com/guide/enterprise-response/cbrestapiquickstart/)
- [How to Write Queries](https://developer.carbonblack.com/resources/query_overview.pdf)

# Configurations

## API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| X-Auth-Token  | API key                            | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Binary Details

Retrieve detailed information for a binary file using its MD5 hash in VMWare Carbon Black EDR.

### Endpoint

- **URL:** `api/v1/binary/{{md5}}/summary`
- **Method:** `GET`

### Input

| **Argument Name**     | **Type** | **Required** | **Description**                          |
| --------------------- | -------- | ------------ | ---------------------------------------- |
| `path_parameters.md5` | string   | Required     | Parameters for the Binary Details action |

### Input Example

`{"path_parameters":{"md5":"BE57857B26F30E6DD658F07DA31E0DFC"}}`

### Output

| **Parameter**            | **Type** | **Description**                        |
| ------------------------ | -------- | -------------------------------------- |
| `status_code`            | number   | HTTP status code of the response       |
| `reason`                 | string   | Response reason phrase                 |
| `host_count`             | number   | Count value                            |
| `digsig_result`          | string   | Result of the operation                |
| `observed_filename`      | array    | Name of the resource                   |
| `product_version`        | string   | Output field: product\_version         |
| `digsig_issuer`          | string   | Output field: digsig\_issuer           |
| `signed`                 | string   | Output field: signed                   |
| `digsig_sign_time`       | string   | Time value                             |
| `orig_mod_len`           | number   | Output field: orig\_mod\_len           |
| `is_executable_image`    | boolean  | Output field: is\_executable\_image    |
| `is_64bit`               | boolean  | Output field: is\_64bit                |
| `digsig_subject`         | string   | Output field: digsig\_subject          |
| `digsig_publisher`       | string   | Output field: digsig\_publisher        |
| `group`                  | array    | Output field: group                    |
| `event_partition_id`     | array    | Unique identifier                      |
| `file_version`           | string   | Output field: file\_version            |
| `company_name`           | string   | Name of the resource                   |
| `internal_name`          | string   | Name of the resource                   |
| `icon`                   | string   | Output field: icon                     |
| `product_name`           | string   | Name of the resource                   |
| `digsig_result_code`     | string   | Result of the operation                |
| `timestamp`              | string   | Output field: timestamp                |
| `copied_mod_len`         | number   | Output field: copied\_mod\_len         |
| `server_added_timestamp` | string   | Output field: server\_added\_timestamp |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:38:55 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:38:55.029248","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:38:55 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

## Block/Unblock MD5 Hash

Isolate a file with a specified MD5 hash or remove it from isolation in VMWare Carbon Black EDR. Requires 'md5hash' and 'isolate' parameters.

### Endpoint

- **URL:** `api/v1/banning/blacklist`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                      |
| ----------------- | -------- | ------------ | ------------------------------------ |
| `md5hash`         | string   | Optional     | Parameter for Block/Unblock MD5 Hash |
| `last_ban_time`   | string   | Optional     | Time value                           |
| `ban_count`       | string   | Optional     | Count value                          |
| `last_ban_host`   | string   | Optional     | Parameter for Block/Unblock MD5 Hash |
| `text`            | string   | Optional     | Parameter for Block/Unblock MD5 Hash |
| `isolate`         | boolean  | Optional     | Parameter for Block/Unblock MD5 Hash |

### Input Example

`{"json_body":{"md5hash":"BE57857B26F30E6DD658F07DA31E0DFC","last_ban_time":"0","ban_count":"0","last_ban_host":"0","text":"banning","isolate":true}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `result`      | string   | Result of the operation          |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:44:59 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:44:59.670237","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:44:59 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

## Get Alerts

Retrieve a list of alerts from VMWare Carbon Black EDR to identify potential threats and take necessary actions.

### Endpoint

- **URL:** `api/v2/alert`
- **Method:** `GET`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                      |
| ----------------- | -------- | ------------ | ------------------------------------ |
| `parameters.q`    | string   | Optional     | Parameters for the Get Alerts action |
| `parameters.rows` | number   | Optional     | Parameters for the Get Alerts action |

### Input Example

`{"parameters":{"q":"status:Unresolved","rows":10}}`

### Output

| **Parameter**          | **Type** | **Description**                     |
| ---------------------- | -------- | ----------------------------------- |
| `status_code`          | number   | HTTP status code of the response    |
| `reason`               | string   | Response reason phrase              |
| `terms`                | array    | Output field: terms                 |
| `terms.file_name`      | string   | Name of the resource                |
| `terms.file`           | string   | Output field: terms.file            |
| `results`              | array    | Result of the operation             |
| `results.file_name`    | string   | Name of the resource                |
| `results.file`         | string   | Result of the operation             |
| `elapsed`              | number   | Output field: elapsed               |
| `comprehensive_search` | boolean  | Output field: comprehensive\_search |
| `all_segments`         | boolean  | Output field: all\_segments         |
| `total_results`        | number   | Result of the operation             |
| `highlights`           | array    | Output field: highlights            |
| `highlights.file_name` | string   | Name of the resource                |
| `highlights.file`      | string   | Output field: highlights.file       |
| `facets`               | object   | Output field: facets                |
| `start`                | number   | Output field: start                 |
| `incomplete_results`   | boolean  | Result of the operation             |
| `filtered`             | object   | Output field: filtered              |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:15:45 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:15:45.562059","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:15:45 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

## Get Sensors

Retrieves detailed information about sensors from VMWare Carbon Black EDR using the specified sensor ID.

### Endpoint

- **URL:** `api/v1/sensor/{{sensor_id}}`
- **Method:** `GET`

### Input

| **Argument Name**                 | **Type** | **Required** | **Description**                       |
| --------------------------------- | -------- | ------------ | ------------------------------------- |
| `path_parameters.sensor_id`       | number   | Required     | Parameters for the Get Sensors action |
| `parameters.hostname`             | string   | Optional     | Parameters for the Get Sensors action |
| `parameters.ipaddr`               | string   | Optional     | Parameters for the Get Sensors action |
| `parameters.groupip`              | string   | Optional     | Parameters for the Get Sensors action |
| `parameters.inactive_filter_days` | number   | Optional     | Parameters for the Get Sensors action |

### Input Example

`{"parameters":{"hostname":"Bob-computer","ipaddr":"1.1.1.1","groupip":"239ewf78w98","inactive_filter_days":1},"path_parameters":{"sensor_id":1}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"status_code":500,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 20:40:51 GMT","Content-Type":"text/html","Content-Length":"291","Connection":"keep-alive","Last-Modified":"2023-01-05 13:40:51.636821","Cache-Control":"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0","Pragma":"no-cache","Expires":"-1"},"reason":"INTERNAL SERVER ERROR","response_text":"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>500 Internal Serv..."}`

## List Banned MD5 Hashes

Retrieves a list of MD5 hashes that have been banned from execution by VMWare Carbon Black EDR.

### Endpoint

- **URL:** `api/v1/banning/blacklist`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:48:13 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:48:13.514064","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:48:13 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

## MD5 Search

Retrieve detailed information for specified MD5 hashes using VMWare Carbon Black EDR.

### Endpoint

- **URL:** `api/v1/binary`
- **Method:** `GET`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                      |
| ----------------- | -------- | ------------ | ------------------------------------ |
| `parameters.q`    | string   | Optional     | Parameters for the MD5 Search action |

### Input Example

`{"parameters":{"q":"BE57857B26F30E6DD658F07DA31E0DFC or 20B146E082833ECEE45452E1494D5254"}}`

### Output

| **Parameter**                    | **Type** | **Description**                  |
| -------------------------------- | -------- | -------------------------------- |
| `status_code`                    | number   | HTTP status code of the response |
| `reason`                         | string   | Response reason phrase           |
| `terms`                          | array    | Output field: terms              |
| `total_results`                  | number   | Result of the operation          |
| `highlights`                     | array    | Output field: highlights         |
| `highlights.name`                | string   | Name of the resource             |
| `highlights.ids`                 | array    | Unique identifier                |
| `facets`                         | object   | Output field: facets             |
| `results`                        | array    | Result of the operation          |
| `results.host_count`             | number   | Result of the operation          |
| `results.original_filename`      | string   | Name of the resource             |
| `results.legal_copyright`        | string   | Result of the operation          |
| `results.digsig_result`          | string   | Result of the operation          |
| `results.observed_filename`      | array    | Name of the resource             |
| `results.product_version`        | string   | Result of the operation          |
| `results.watchlists`             | array    | Result of the operation          |
| `results.watchlists.wid`         | string   | Unique identifier                |
| `results.watchlists.value`       | string   | Value for the parameter          |
| `results.facet_id`               | number   | Unique identifier                |
| `results.digsig_issuer`          | string   | Result of the operation          |
| `results.copied_mod_len`         | number   | Result of the operation          |
| `results.server_added_timestamp` | string   | Result of the operation          |
| `results.digsig_sign_time`       | string   | Result of the operation          |
| `results.orig_mod_len`           | number   | Result of the operation          |
| `results.is_executable_image`    | boolean  | Result of the operation          |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:08:29 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:08:29.295477","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:08:29 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

## Modify Sensor

Update settings for a specific sensor in VMWare Carbon Black EDR using the sensor's unique identifier.

### Endpoint

- **URL:** `api/v1/sensor/{{sensor_id}}`
- **Method:** `PUT`

### Input

| **Argument Name**                      | **Type** | **Required** | **Description**                         |
| -------------------------------------- | -------- | ------------ | --------------------------------------- |
| `path_parameters.sensor_id`            | number   | Required     | Parameters for the Modify Sensor action |
| `parameters.network_isolation_enabled` | string   | Optional     | Parameters for the Modify Sensor action |

### Input Example

`{"parameters":{"network_isolation_enabled":"network_isolation_enabled"},"path_parameters":{"sensor_id":1}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"status_code":500,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 21:03:51 GMT","Content-Type":"text/html; charset=utf-8","Content-Length":"44","Connection":"keep-alive","Last-Modified":"2023-01-05 14:03:51.779964","Cache-Control":"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0","Pragma":"no-cache","Expires":"-1"},"reason":"INTERNAL SERVER ERROR","response_text":"Unhandled exception. Check logs for details."}`

## Process Search

Execute a search query for processes within VMWare Carbon Black EDR and retrieve relevant process information.

### Endpoint

- **URL:** `api/v1/process`
- **Method:** `GET`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                          |
| ----------------- | -------- | ------------ | ---------------------------------------- |
| `parameters.q`    | string   | Optional     | Parameters for the Process Search action |
| `parameters.rows` | number   | Optional     | Parameters for the Process Search action |

### Input Example

`{"parameters":{"q":"process_name:svchost.exe","rows":10}}`

### Output

| **Parameter**          | **Type** | **Description**                     |
| ---------------------- | -------- | ----------------------------------- |
| `status_code`          | number   | HTTP status code of the response    |
| `reason`               | string   | Response reason phrase              |
| `terms`                | array    | Output field: terms                 |
| `results`              | array    | Result of the operation             |
| `results.file_name`    | string   | Name of the resource                |
| `results.file`         | string   | Result of the operation             |
| `elapsed`              | number   | Output field: elapsed               |
| `comprehensive_search` | boolean  | Output field: comprehensive\_search |
| `all_segments`         | boolean  | Output field: all\_segments         |
| `total_results`        | number   | Result of the operation             |
| `highlights`           | array    | Output field: highlights            |
| `highlights.file_name` | string   | Name of the resource                |
| `highlights.file`      | string   | Output field: highlights.file       |
| `facets`               | object   | Output field: facets                |
| `tagged_pids`          | object   | Unique identifier                   |
| `start`                | number   | Output field: start                 |
| `incomplete_results`   | boolean  | Result of the operation             |
| `filtered`             | object   | Output field: filtered              |

### Output Example

`{"status_code":200,"response_headers":{"Server":"openresty","Date":"Thu, 05 Jan 2023 19:34:38 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Last-Modified":"2023-01-05 12:34:38.702167","Cache-Control":"max-age=0","Pragma":"no-cache","Expires":"Thu, 05 Jan 2023 19:34:38 GMT","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"DENY, DENY","X-Content-Type-Options":"nosniff","Content-Encoding":"gzip"},"reason":"OK","json_b...`

# Response Headers

| **Header**                | **Description**                                                                      | **Example**                   |
| ------------------------- | ------------------------------------------------------------------------------------ | ----------------------------- |
| Cache-Control             | Directives for caching mechanisms                                                    | max-age=0                     |
| Connection                | HTTP response header: Connection                                                     | keep-alive                    |
| Content-Encoding          | HTTP response header: Content-Encoding                                               | gzip                          |
| Content-Length            | The length of the response body in bytes                                             | 44                            |
| Content-Type              | The media type of the resource                                                       | text/html; charset=utf-8      |
| Date                      | The date and time at which the message was originated                                | Thu, 05 Jan 2023 20:40:51 GMT |
| Expires                   | The date/time after which the response is considered stale                           | Thu, 05 Jan 2023 19:15:45 GMT |
| Last-Modified             | The date and time at which the origin server believes the resource was last modified | 2023-01-05 12:34:38.702167    |
| Pragma                    | HTTP response header: Pragma                                                         | no-cache                      |
| Server                    | Information about the software used by the origin server                             | openresty                     |
| Strict-Transport-Security | HTTP response header: Strict-Transport-Security                                      | max-age=31536000              |
| Transfer-Encoding         | HTTP response header: Transfer-Encoding                                              | chunked                       |
| X-Content-Type-Options    | HTTP response header: X-Content-Type-Options                                         | nosniff                       |
| X-Frame-Options           | HTTP response header: X-Frame-Options                                                | DENY, DENY                    |