VMware Carbon Black

Export software inventory from VMware Carbon Black (Carbon Black Cloud) and upload it with the SIM template.

VMware Carbon Black Cloud collects endpoint telemetry and inventory data via its sensor. The relevant data sources for SIM import include:

• Endpoints (Devices), Device name, operating system, and sensor status.
• Installed Applications, Software name, version, and publisher detected on endpoints.
• Carbon Black Cloud REST API, Programmatic access to device and application inventory data.

Note: Application inventory visibility requires Live Response / Inventory features to be enabled in your Carbon Black tenant.

• Access to the Carbon Black Cloud Console.
• Role with permission to view Endpoints and Inventory data.
• Carbon Black sensors deployed and actively reporting.
• Permission to export inventory or report data to CSV.

• Carbon Black API credentials (API ID and API Secret).
• Organization Key and API Base URL (region-specific).
• Access to the Carbon Black Cloud API (https://defense.conferdeploy.net or regional equivalent).
• PowerShell, curl, or Postman for REST API queries.
• (Recommended) Familiarity with API pagination and rate limits.

This method is suitable for manual or ad-hoc exports.

1. Log in to the Carbon Black Cloud Console.
2. Navigate to Endpoints → Inventory (or Live Response → Applications, depending on tenant configuration).
3. Apply filters as required (e.g. all endpoints, Windows-only).
4. Ensure the following fields are visible:

• Device Name
• Application Name
• Version
• Publisher

5. Click Export → CSV.
6. Save the file as CarbonBlack_SIM_Export.csv.

Tip: You can save views or filters to simplify recurring exports.

For automated or large-scale environments, use the Carbon Black Cloud REST API.

# VMware Carbon Black SIM Template Export Script
# Requires Carbon Black Cloud API credentials

$OrgKey = "YOUR_ORG_KEY"
$ApiId = "YOUR_API_ID"
$ApiSecret = "YOUR_API_SECRET"
$BaseUrl = "https://defense.conferdeploy.net"
$ExportPath = "C:\Exports\CarbonBlack_SIM_Export.csv"

$Headers = @{
    "X-Auth-Token" = "$ApiSecret/$ApiId"
    "Accept"      = "application/json"
}

# Retrieve devices
$DevicesUrl = "$BaseUrl/appservices/v6/orgs/$OrgKey/devices/_search"
$DevicesBody = @{
    criteria = @{}
    rows     = 1000
    start    = 0
} | ConvertTo-Json

$DevicesResponse = Invoke-RestMethod -Uri $DevicesUrl -Headers $Headers -Method Post -Body $DevicesBody -ContentType "application/json"

$ExportData = @()

foreach ($Device in $DevicesResponse.results) {
    $DeviceName = $Device.name
    $DeviceId = $Device.id

    # Retrieve installed applications per device
    $AppsUrl = "$BaseUrl/appservices/v6/orgs/$OrgKey/devices/$DeviceId/applications"
    $AppsResponse = Invoke-RestMethod -Uri $AppsUrl -Headers $Headers -Method Get

    foreach ($App in $AppsResponse) {
        $ExportData += [PSCustomObject]@{
            "Device Name"        = $DeviceName
            "Software Name"      = $App.name
            "Software Version"   = $App.version
            "Software Publisher" = $App.publisher
        }
    }
}

# Export to CSV
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "Export complete: $ExportPath"

For large environments, implement pagination using the start and rows parameters.

The CSV header row must be exactly Device Name,Software Name,Software Version,Software Publisher.

1. Open the Licenseware SIM Template.
2. Go to the Software Inventory tab.
3. Paste the CSV data into the template

Remove blank or extraneous rows before saving.

Then upload it on the SIM - Template data source. See SIM template.

Device Name,Software Name,Software Version,Software Publisher
LAPTOP-001,Google Chrome,129.0.6668.90,Google LLC
SERVER-02,Microsoft SQL Server 2022,16.0.432,Microsoft Corporation
LAPTOP-004,Slack,4.39.95,Slack Technologies
WS-015,Adobe Acrobat DC,24.002.20933,Adobe Inc.