VMware Carbon Black Data Extraction Guide (for SIM Template)

VMware Carbon Black Cloud collects endpoint telemetry and inventory data via its sensor.
The relevant data sources for SIM import include:

• Endpoints (Devices) – Device name, operating system, and sensor status.

• Installed Applications – Software name, version, and publisher detected on endpoints.

• Carbon Black Cloud REST API – Programmatic access to device and application inventory data.

Note: Application inventory visibility requires Live Response / Inventory features to be enabled in your Carbon Black tenant.

Prerequisites

For Console (UI) Method

• Access to the Carbon Black Cloud Console.

• Role with permission to view Endpoints and Inventory data.

• Carbon Black sensors deployed and actively reporting.

• Permission to export inventory or report data to CSV.

For API Method

• Carbon Black API credentials (API ID and API Secret).

• Organization Key and API Base URL (region-specific).

• Access to the Carbon Black Cloud API (https://defense.conferdeploy.net or regional equivalent).

• PowerShell, curl, or Postman for REST API queries.

• (Recommended) Familiarity with API pagination and rate limits.

Recommended Query or Method

Two supported extraction methods are available.

Option 1: Carbon Black Cloud Console Export (UI)

This method is suitable for manual or ad-hoc exports.

Steps

1. Log in to the Carbon Black Cloud Console.

2. Navigate to Endpoints → Inventory (or Live Response → Applications, depending on tenant configuration).

3. Apply filters as required (e.g. all endpoints, Windows-only).

4. Ensure the following fields are visible:

   • Device Name

   • Application Name

   • Version

   • Publisher

5. Click Export → CSV.

6. Save the file as CarbonBlack_SIM_Export.csv.

Tip: You can save views or filters to simplify recurring exports.

Option 2: Carbon Black Cloud REST API (Recommended for Automation)

For automated or large-scale environments, use the Carbon Black Cloud REST API.

Step 1: Set API Configuration

# VMware Carbon Black SIM Template Export Script
# Requires Carbon Black Cloud API credentials

$OrgKey = "YOUR_ORG_KEY"
$ApiId = "YOUR_API_ID"
$ApiSecret = "YOUR_API_SECRET"
$BaseUrl = "https://defense.conferdeploy.net"
$ExportPath = "C:\Exports\CarbonBlack_SIM_Export.csv"

$Headers = @{
    "X-Auth-Token" = "$ApiSecret/$ApiId"
    "Accept"      = "application/json"
}

Step 2: Retrieve Devices and Installed Applications

# Retrieve devices
$DevicesUrl = "$BaseUrl/appservices/v6/orgs/$OrgKey/devices/_search"
$DevicesBody = @{
    criteria = @{}
    rows     = 1000
    start    = 0
} | ConvertTo-Json

$DevicesResponse = Invoke-RestMethod -Uri $DevicesUrl -Headers $Headers -Method Post -Body $DevicesBody -ContentType "application/json"

$ExportData = @()

foreach ($Device in $DevicesResponse.results) {
    $DeviceName = $Device.name
    $DeviceId = $Device.id

    # Retrieve installed applications per device
    $AppsUrl = "$BaseUrl/appservices/v6/orgs/$OrgKey/devices/$DeviceId/applications"
    $AppsResponse = Invoke-RestMethod -Uri $AppsUrl -Headers $Headers -Method Get

    foreach ($App in $AppsResponse) {
        $ExportData += [PSCustomObject]@{
            "Device Name"        = $DeviceName
            "Software Name"      = $App.name
            "Software Version"   = $App.version
            "Software Publisher" = $App.publisher
        }
    }
}

# Export to CSV
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "Export complete: $ExportPath"

For large environments, implement pagination using the start and rows parameters.

Exporting to CSV

• Console Method:
  Export directly from the Inventory or Applications view as CSV.

• API Method:
  The PowerShell script generates CarbonBlack_SIM_Export.csv.

Ensure the CSV includes the following headers: