Carbon Black

Carbon Black

· #416 most-used

Detect, investigate, and respond to endpoint threats — automatically

DeveloperSecurityAutomationCloud & InfrastructureMonitoring & Alerts

Carbon Black (now Broadcom Carbon Black Cloud) is an enterprise endpoint security platform that delivers next-generation antivirus, endpoint detection and response (EDR), and threat hunting capabilities through a cloud-native agent. It continuously monitors process execution, file activity, and network connections across every managed endpoint — generating alerts when behaviour matches threat patterns or policy violations. Connect it to Actionist and your agents can search and triage alerts, enrich incidents with full device and process context, quarantine compromised endpoints within about a minute of detection, hunt for IOC matches across the fleet, and build a continuous compliance evidence store from audit logs — all without an analyst touching the Carbon Black console.

Average time saved
7 hours
per person · per month
≈ 1 workdays back

Eliminates manual work. Agents eliminate manual alert triage, console-based device lookups, copy-paste incident ticketing, and weekly audit log export cycles that together consume hours of analyst and compliance time each week.

Schedule

What your Carbon Black agent runs on autopilot

A week of scheduled jobs your Actionist agent will execute on your behalf.

28Scheduled jobs
7Agents at work
24/7Always on
Agents
TueThu
Tue
Wed
Thu
7a
8a
9a
10a
11a
12p
1p
2p
3p
4p
5p
6p
Multi-app workflows

Carbon Black × every other app you use

End-to-end automations that span multiple apps — each one a real business outcome.

6Workflows
6Apps spanned
~18 hrsSaved / week
5Personas served
For security operations
Featured3 apps

Critical alert contained and ticketed within a minute

When a Critical Carbon Black alert is detected, the agent retrieves full alert and device context, immediately quarantines the endpoint, posts a containment notice to the incident response channel, and creates a richly populated P1 ticket in Jira — all within about a minute of detection, before the on-call analyst picks up their phone.

~5 hrs

Time saved for your team — every week, on autopilot

The flow
Trigger·When a Critical Carbon Black alert is detected by the scheduled monitoring task
write
Step 6
J
Jira
Create P1 incident ticket with enriched alert payload
Result
Quarantine the affected devicePost containment notice with alert details to #incident-responseCreate P1 incident ticket with enriched alert payload
The win
Saved per run
35 min
Runs / week
~8×
No critical threat sits uncontained while analysts are paged
Driven byOperations Agent
ROI

Savings

What your team gets back — two angles: what you stop doing manually, and what that's worth.

Without Actionist

What you do manually today

With Actionist

What your agent runs for you

  • Sales
    20 min / week
    Manual security posture prep for prospect calls

    Account managers manually log into the CB console before each renewal or expansion call to pull device counts and alert summaries, spending 15 minutes per account.

    Sales Agent
    0 min
    Agent pulls device and alert data automatically before calls

    The agent retrieves Carbon Black device coverage and alert counts for prospect accounts and writes the security posture summary to HubSpot before Monday morning calls — no manual console login.

  • Marketing
    15 min / week
    Manual alert data export for content research

    The marketing team manually exports Carbon Black alert summaries from the console, reformats the data in a spreadsheet, and shares it with content writers each month.

    Marketing Agent
    0 min
    Agent pulls threat trend data for content on schedule

    Every Tuesday the agent retrieves Carbon Black alert volume and severity distribution and writes the threat landscape data to the content team's research document — no manual data export.

  • Customer Support
    40 min / week
    Manual alert-to-ticket creation

    Analysts manually check the Carbon Black alert queue, copy relevant details into the ticketing system, and look up device information separately — 10 minutes per alert.

    Customer Support Agent
    0 min
    Agent creates enriched tickets from untracked alerts automatically

    The support agent detects High and Critical alerts without tickets, creates pre-populated incident records with full device and alert context — no analyst has to copy-paste from the CB console.

  • Human Resources
    12 min / week
    Manual offboarding device security steps

    HR submits a ticket to IT security, who manually looks up the employee's devices in Carbon Black, quarantines each one, and marks the offboarding checklist — a process that takes hours and is often missed.

    Human Resources Agent
    0 min
    Agent quarantines and deregisters offboarding devices automatically

    When an employee is offboarded, the agent finds their devices in Carbon Black, quarantines them, notifies IT, and updates the offboarding checklist — without any manual security team involvement.

  • Finance
    25 min / week
    Manual cyber insurance coverage evidence prep

    Finance manually coordinates with IT to get Carbon Black coverage numbers, reformats the data into the compliance register, and chases for updates if coverage is below threshold.

    Finance Agent
    0 min
    Agent calculates and logs insurance coverage metrics monthly

    When the monthly cyber insurance review fires, the agent retrieves Carbon Black device and policy data, calculates coverage rates, writes the evidence to the compliance register, and flags any shortfall.

  • Operations
    90 min / week
    Manual alert triage, containment, and closure pipeline

    Security analysts manually check the CB console for new alerts, copy details to incident tickets, quarantine devices from a separate UI tab, and dismiss resolved alerts manually after each incident closes.

    Operations Agent
    0 min
    Agent runs the full alert-to-closure pipeline automatically

    The operations agent detects new critical alerts, enriches them, quarantines devices, creates tickets, and syncs closures back to Carbon Black — the entire pipeline runs without manual intervention.

  • Legal
    35 min / week
    Manual audit log export and compliance filing

    Legal counsel manually requests CB audit log exports from IT, reformats the data for the compliance register, and manually checks each entry against the approved change request log.

    Legal Agent
    0 min
    Agent builds compliance evidence packages automatically each week

    The legal agent retrieves Carbon Black audit logs weekly, compiles the regulatory evidence package, files it to the compliance repository, and flags out-of-window changes — no manual console export.

+ 100s of other Carbon Black automations
Average time saved
24 hrs / person / month
Calculator

Calculate what your team saves

Team size
5 people
Hourly rate
$75 / hr
Hours saved / week
9
Hours saved / year
450
Annual ROI
$33,750

Based on Carbon Black's typical team usage — the visible tasks plus a few other automations the agent runs: ~1.8 hrs / person / week of admin work automated.

Connect

How to plug Carbon Black into Actionist

Pick the connection method that suits your environment.

Carbon Black Cloud uses an API ID + API Secret Key pair alongside your Organisation Key and regional API URL. All four values are required for authenticated API calls. Generate them in the CB Cloud console under Settings → API Access.

1
Configure an API Access Level

Log into the Carbon Black Cloud console and go to Settings → API Access → Access Levels. Create or select an access level with the permissions appropriate for your use case (READ for monitoring, EXECUTE for response actions).

2
Create an API Key

Go to Settings → API Access → API Keys and click Add API Key. Select your access level, give the key a descriptive name, and click Save. Copy both the API ID and the API Secret Key — the secret is only shown once.

3
Copy credentials into Actionist

Copy your Organisation Key from the top of the API Access page. Also note your API URL (the hostname in your console's browser address bar). Paste all four values — API ID, API Secret Key, Organisation Key, and API URL — into Actionist and click Test connection.

Credentials you'll need
API ID*
Carbon Black Cloud console → Settings → API Access → API Keys → Add API Key → copy the API ID
API Secret Key*
Carbon Black Cloud console → Settings → API Access → API Keys → Add API Key → copy the API Secret Key
Organisation Key*
Your organisation key from Settings → API Access (e.g. ABCD1234)
API URL*
Your Carbon Black Cloud hostname (e.g. defense.conferdeploy.net or defense-eu.conferdeploy.net)
Actions

15 actions your agent can call

Read and write operations available to your Actionist agent.

Triggers

0 events your agent can react to

Events your agent watches for, and the actions it kicks off in response.

This app has no triggers yet.
MCP servers

MCP servers that work with Carbon Black

Connect Actionist to MCP servers built for or around this app.

VMware AIops

AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 31 MCP tools.

VMware Aria Operations

VMware Aria Operations: metrics, alerts, capacity, anomaly detection — 18 MCP tools.

VMware AVI

VMware AVI (NSX ALB) load balancer plus AKO Kubernetes ops — 29 MCP tools.

VMware Harden

VMware compliance scanning (CIS, vSphere SCG, GB/T 22239, PCI-DSS) with drift detection.

VMware Monitor

Read-only VMware vCenter/ESXi monitoring with 8 MCP tools. Code-level safety.

VMware NSX

VMware NSX networking management with 31 MCP tools: segments, gateways, NAT, routing, IPAM.

VMware Storage

VMware vSphere storage management with 11 MCP tools: datastores, iSCSI, vSAN.

FAQs

Questions about Carbon Black + Actionist

How does Actionist connect to Carbon Black Cloud?
Go to the Apps tab, find Carbon Black, and click Connect. Choose API Key as the connection method. In your Carbon Black Cloud console, navigate to Settings → API Access → API Keys and create a new key with the access level you need (Custom or Administrator). Copy the API ID and API Secret Key, then paste both into Actionist. The agent runs a test call to confirm the connection before any actions run.
What permissions does the agent need on my Carbon Black account?
Carbon Black Cloud uses a role-based API access control system. For read-only operations — searching alerts, listing devices, pulling audit logs — a Custom key with READ permission on those resource types is sufficient. For write operations — dismissing alerts, quarantining devices, updating policies — your API key needs the corresponding EXECUTE or READ+UPDATE permissions. You also need your Organization Key and the correct API URL for your region. The Carbon Black console under Settings → API Access → Access Levels lets you configure exactly which operations each key is permitted.
Can I connect Carbon Black to other apps in the same Actionist workflow?
Yes — Carbon Black is most valuable when combined with your ticketing, communication, and SIEM tools. Common combinations: route new CB alerts into Jira or ServiceNow as incidents; post high-severity alerts to a dedicated Slack channel; quarantine a device and immediately update the related HubSpot or Salesforce record; pull weekly device compliance data into Google Sheets for reporting. Any of Actionist's 200+ connected apps can send or receive data alongside Carbon Black in the same workflow.
What are the most common things agents do with Carbon Black?
The four patterns that come up most often: (1) alert triage — new CB alerts are enriched with device and process context, then routed to the right analyst or ticketing system based on severity and policy; (2) device compliance sweeps — weekly scans for devices that are offline, out-of-policy, or running outdated sensors with automatic remediation tasks created; (3) threat hunting — searching process events and watchlist hits for IOC patterns and correlating findings with other data sources; (4) incident response — quarantining a device, pulling an audit log entry, and creating a full incident record in your ITSM tool, all in one coordinated agent task.
How quickly does Actionist detect a new Carbon Black alert?
Carbon Black Cloud does not expose webhook-based push triggers through its standard REST API. Actionist polls CB on a configurable schedule — by default every few minutes — to detect new alerts, device state changes, and watchlist hits. When a new alert matching your criteria appears, the agent fires your downstream workflow within about a minute of the poll cycle. For near-real-time response to critical severity events, set a short polling interval on the alert-monitoring task.
Can I filter Carbon Black alerts by severity or type before acting on them?
Carbon Black Cloud organises alerts by severity (Critical, High, Medium, Low) and type (CB Analytics, Watchlist, Device Control). In Actionist, you can filter the Search Alerts action by any combination of severity, alert type, device name, policy name, process name, or time range. Set the filter tightly in the scheduled task so only the alert category you care about triggers downstream steps — for example, only Critical CB Analytics alerts on production servers route directly to PagerDuty, while lower-severity alerts create a backlog ticket in Jira.
What happens when Actionist quarantines a device — and how is the quarantine lifted?
The Quarantine Device action in Actionist isolates the targeted endpoint from the network while preserving the Carbon Black sensor connection and local logging. The device remains quarantined until you explicitly release it using the Update Device (release quarantine) action. Actionist does not automatically release quarantine — the release step must be deliberate, either triggered by an analyst approval action in the same workflow or run as a separate agent task after the investigation is complete.
Can Actionist use Carbon Black's audit logs for compliance reporting?
Yes. The Get Audit Logs action retrieves a time-stamped record of console user and API key activity — every CREATE, UPDATE, and DELETE action performed in your Carbon Black organization. In Actionist, a weekly agent task can pull the audit log, filter for sensitive operations (policy changes, API key creation, bulk alert dismissals), and write the results to a Google Sheets compliance register or push them to your SIEM. This supports SOC 2, ISO 27001, and other frameworks that require evidence of privileged-access monitoring.