VMware Carbon Black App Control (formerly known as Carbon Black Protection)

The IBM QRadar DSM for VMware Carbon Black App Control collects Syslog events from a Carbon Black App Control device.

To integrate Carbon Black App Control with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download the most recent version of the following RPMs from the IBM® support website (http://www.ibm.com/support).
    • DSM Common RPM
    • Carbon Black App Control DSM RPM
  2. Configure your Carbon Black App Control device to send events to QRadar. For more information, see Configuring VMware Carbon Black App Control to communicate with QRadar.
  3. If QRadar does not automatically detect the log source, add a Carbon Black App Control log source on the QRadar Console. For more information, see Syslog log source parameters for VMware Carbon Black App Control.