This guide is for the configuration of Carbon Black Response only. Support for Carbon Black Defense (Cloud) was added as of version 6.6. Documentation for that configuration is not yet available. Please see the 6.6 release notes for more information on Carbon Black Defense: Vectra Cognito 6.6 Release Notes
Carbon Black integration can be enabled in the UI: Settings → External Connectors page.
Click “Edit” next to “Enable integration with Carbon Black”
Click the “Off” button to toggle to “On”
In the box for “Server IP/domain name”, enter the IP address and port for the Carbon Black Response API.
All API requests must be authenticated by using an API key. In the box for “API key”, enter the API token obtain from Carbon Black Response.
To find your Carbon Black Response API key: Login to Carbon Black and click the “API Token” button on the left hand side to reveal the API token. If there is no API token displayed, click the “Reset” button to create a new one. For more details see :
Click “Save" in Vectra
Now, the integration with Carbon Black Response is complete.