VMware Carbon Black Cloud for IT Service Management
by VMware LLC
Streamline security operations workflows with Carbon Black Cloud endpoint context and response actions directly in ServiceNow ITSM
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2025-11-02 | 10 | - |
| 117 days of no change | ||
| 2025-07-07 | 9 | +1 |
| 131 days of no change | ||
| 2025-02-25 | 8 | +1 |
About
The VMware Carbon Black Cloud for IT Service Management app automates the creation of ServiceNow ITSM Incident tickets from Carbon Black Cloud alerts to streamline and simplify the management of alerts for security teams.
By automating the creation of ITSM Incident tickets, this application eliminates the need to manually correlate data between systems by seamlessly transferring endpoint alerts and context from Carbon Black Cloud to ServiceNow’s ITSM module. This integration arms teams with security context directly from Carbon Black, enabling them to respond with speed and confidence.
Additionally, this application provides the ability to gather context and conduct remediation actions on Carbon Black Cloud endpoints as part of Security Orchestration, Automation, and Response (SOAR) workflows, to resolve incidents in a single pane of glass.
Users should install this app along with the VMware Carbon Black Cloud app to access the full capabilities of this integration, including ingestion of Carbon Black Cloud inventory data to the ServiceNow Configuration Management Database (CMDB) module.
VMware Carbon Black Cloud:
* The VMware Carbon Black Cloud is a cloud-native endpoint, workload, and container protection platform that combines the intelligent system hardening and behavioral prevention needed to keep emerging threats at bay, using a single, easy-to-use console. By analyzing more than 1 trillion security events per day, VMware Carbon Black Cloud proactively uncovers attackers’ behavior patterns and empowers defenders to detect and stop emerging attacks.
* https://www.vmware.com/products/carbon-black-cloud-endpoint.html
Key Features
Dashboard
* Dashboard for viewing metrics related to alerts, assets, incidents, security incidents and vulnerabilities.
Carbon Black Cloud Alert Ingestion
* Customizable alert ingestion from Carbon Black Cloud to ServiceNow via the Alerts API or Data Forwarder.
* Multi-tenancy: domain separation to configure ingestion and isolation of Alerts data from multiple Carbon Black Cloud organizations.
Carbon Black Cloud Asset Inventory Ingestion
* Creation of ServiceNow Configuration Items based on Carbon Black Cloud endpoints and workloads.
* Synchronization of asset context from Carbon Black Cloud to the ServiceNow Configuration Management Database (CMDB).
* Attachment of Carbon Black Cloud Assets to ServiceNow ITSM and VR ticket types.
Streamlined ServiceNow ITSM Incident Creation and Lifecycle Management
* Automated and manual ServiceNow ITSM Incident ticket creation based on Carbon Black Cloud Alerts.
* Customizable field mappings between Carbon Black Cloud Alerts and ServiceNow ITSM Incident tickets.
* Automated, bi-directional updates between Carbon Black Cloud and ServiceNow for alerts, updates, and dismissal.
SOAR Capabilities
* Built-in context and remediation actions for Security Orchestration, Automation, and Response (SOAR) workflows. Examples include:
* Quarantine Asset
* Ban Process Hash
* Update Asset Policy
* Get Process Metadata
* Kill Process
* Automated logging and record keeping of incident response actions in ITSM Incident ticket work notes.