Get started with the Carbon Black integration

Carbon Black is an advanced security system easily integrating with Security Operations. Before you can use the Carbon Black integration, you must download the integration from the ServiceNow Store and add the appropriate Endpoint Base and API Token.

Before you begin

Role required: sn_si_admin

Procedure

1. Download the integration from the ServiceNow Store.

2. When the installation is complete, access the Carbon Black website and obtain the Endpoint Base URL and API Token under your profile.

3. In your instance, navigate to Security Operations > Integrations > Integration Configurations.

   The available security integrations appear as a series of cards.

4. In the Carbon Black card, click New.

1. Fill in the fields, as needed.

   Field	Description
   Name	The name of this configuration.
   Endpoint Base	The endpoint base you acquired from the Carbon Black site.
   API Token	The API token you acquired from the Carbon Black site.
   Use MID Server	Select this check box if it is not already checked.
   MID Server	Select Any to use any active MID Server, or select a specific MID Server name.
   Enable Isolate Host	Select this check box to allow selected configuration items to be isolated from the Configuration Items related list tab in a security incident.

   Note: Configuring this integration activates workflows. To manage the workflows, navigate to the Workflow Editor.

2. Select Submit.

   The integration configuration card displays.

3. To return to the original list of integration configuration cards, select No from the Show Configurations drop-down list.