--- title: Carbon Black EDR Integration  description: "The Carbon Black EDR (Endpoint Detection and Response) tool visualizes and collects extensive information for vigilant threat hunting and accelerated incidence response. The endpoint events are collected at an enormous scale for increased visibility into the changing threat landscape.\n\nSIRP integrates with Carbon Black’s EDR for the enrichment of activity data, improved visibility into threat patterns, and extended automation for removing or containing threats." --- [Skip to content](https://content.sirp.io/knowledge-base/carbon-black-edr-integration-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # Carbon Black EDR Integration ### **About Carbon Black** The Carbon Black EDR (Endpoint Detection and Response) tool visualizes and collects extensive information for vigilant threat hunting and accelerated incidence response. The endpoint events are collected at an enormous scale for increased visibility into the changing threat landscape. SIRP integrates with Carbon Black’s EDR for the enrichment of activity data, improved visibility into threat patterns, and extended automation for removing or containing threats. Comprehensive security coverage by Carbon Black, combined together with SIRP’s risk-based SOAR platform provides SOC teams with an unparalleled defense posture. The SOC teams have access to active threats, accelerated visibility and detection, and complete information on artifacts to provide context and threat validation. ### **Supported Actions** SIRP’s Carbon Black integration app allows you to execute the following actions: | **S.no** | **Action** | **Description** | | --- | --- | --- | | 1 | block hash | Block a hash through Carbon Black. | | 2 | get alerts | Get new alerts from Carbon Black. | | 3 | get\_process\_info\_for\_segment | Get process information against the process ID from Carbon Black. | | 4 | get\_process\_info | Get the process name from Carbon Black. | ### **Enable and Configure the Carbon Black App** Below mentioned are the steps to generate an API key for usage: 1. Log in to your Cabon Black instance 2. Click on **Username** dropdown then select **My Profile** \> **API Token.** 3. Copy the API Token [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/FG1FExDmJDQOqHJ-4fG1LTJFZnc0EtB5NCrMQkcg3MWeE1G0dO5T_3aaAcTqS49iFxp3Xo-y6cuXgztEM9Ugb80qfU20JDNFA-GEAiuJ48GkHaQE18bJdmBCM9LA8A.png)](https://sirp.intercom-attachments-7.com/i/o/363776183/55bfc627fc5cc36243e4f537/FG1FExDmJDQOqHJ-4fG1LTJFZnc0EtB5NCrMQkcg3MWeE1G0dO5T_3aaAcTqS49iFxp3Xo-y6cuXgztEM9Ugb80qfU20JDNFA-GEAiuJ48GkHaQE18bJdmBCM9LA8A?expires=1752237000&signature=199d88b1188be172691d301bd1136c6fc99100ca3fc9e7f9ade4be12f6326fe6&req=dyYkEc54nIlcFb4f3HP0gHZOPxe7SCwlMc%2FlgOJ2YZ7mL2OPDhNTNRiQLYBS%0AdsJEh61YSYKI8F6NvQ%3D%3D%0A) ### **Configure The SIRP App** 1. Next, log in to SIRP, then go to **Apps** from the left navigation bar 2. Locate the **Carbon Black** App. 3. Click on the **Toggle button** to **enable** the app. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-57-15-5469-AM.png)](https://downloads.intercomcdn.com/i/o/599832252/19403fdad34d559805958640/image.png?expires=1752237000&signature=a93dbd2502c5b4b072914f9e0636d0d2b53ec52d99ea9474750f16dc8ba6b925&req=cSkuHsp8n4RdFb4f3HP0gI5Qsk%2FUCT0c%2FmRLSBwbUTClE3rGReP9Y5HWPBKQ%0AAU7hokecite%2FbpGPwg%3D%3D%0A) 4\. As soon as you enable the App, you will get an option to **add** the configuration details. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-57-21-1572-AM.png)](https://downloads.intercomcdn.com/i/o/599832676/69ea0a8a7e12416904226373/image.png?expires=1752237000&signature=8629ba02f4f0bd545ecaaa0928599c54062e1cbbe298e30e68d708a5945cbb12&req=cSkuHsp8m4ZZFb4f3HP0gPSfpxiL%2FJ3LlL9v03VPi4IH%2Bt2NLVFl%2Bk3x2vMj%0A3%2Bm5dEd3moWFAkkjjw%3D%3D%0A) 5\. Add the following details and click **Save**: - **Configuration Name** \ - **Host** \ - **API-Key** \ ### **Carbon Black In Action** Once the integration between SIRP and Carbon Black is complete, you can execute all the supported actions. For example, click on a hash, then select Carbon Black EDR \> block hash. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-57-26-3474-AM.png)](https://downloads.intercomcdn.com/i/o/599833929/4edab53e08850aa0bd53e7d1/image.png?expires=1752237000&signature=8dcd6b326d096adf63f0735918c5c0ef598c4a2efce67ab574f3c0c919d7393b&req=cSkuHsp9lINWFb4f3HP0gD2JAdPzTmP36DOnb0v65IDs%2FtX2yLeFn1692ihw%0A81R%2FHtqf6vOB37b59w%3D%3D%0A) Once the action is successfully executed, the hash would have been blocked within Carbon Black EDR. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/dg_-ecoFA5HyWkFLtgq5mPhvdsYC9jPyjpABenNTkDvoRDTTuvkBadxjHxrygCAB_tq5Q-J4HaRWAE6DmMoiTw4-gdSwBrpdAnr5M7O29_Wn8Zt9S_anpdn4CZthqg.png)](https://sirp.intercom-attachments-7.com/i/o/363776191/b775cd8e539921666875298a/dg_-ecoFA5HyWkFLtgq5mPhvdsYC9jPyjpABenNTkDvoRDTTuvkBadxjHxrygCAB_tq5Q-J4HaRWAE6DmMoiTw4-gdSwBrpdAnr5M7O29_Wn8Zt9S_anpdn4CZthqg?expires=1752237000&signature=09c57504e64a81463bdb383c022f68dff414fdad6a6adc1ae9d42d076925593f&req=dyYkEc54nIheFb4f3HP0gCKImvC8LswQsvkFqcBP1zB4x%2BSkJGPkTCh43BK3%0AGhwpOZ8InGvbESu%2BCQ%3D%3D%0A) - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc