To enable and configure Carbon Black File Reputation, perform the following procedure.

Note: You might be prompted to provide your Customer Portal login credentials to gain access to the Carbon Black File Reputation Options page. Have these credentials available.

Procedure

  1. On the console menu, click the Configuration (gear) icon and click System Configuration.
  2. Click the Licensing tab. The Licensing configuration options display, with the Carbon Black File Reputation Activation and Proxy Settings panels at the bottom of the page.
  3. To use a Proxy Server to communicate with Carbon Black File Reputation, go to the Carbon Black File Reputation Proxy Settings panel, click Edit, and configure the settings as described in the following table. See Using a Proxy Server for Carbon Black File Reputation if the proxy server requires authentication.
    Table 1. Carbon Black File Reputation Proxy Settings

    Field/Button

    Description

    Proxy Settings: Enabled

    If selected, use of a proxy server for communication with Carbon Black File Reputation is enabled. You must provide its URL in the URL text box.

    Proxy Settings: URL

    The URL to use as proxy for Carbon Black File Reputation communications. You can use a hostname or an IP address, and optionally add a port specification.

  4. Click Update and then click Yes in the confirmation dialog box.
  5. If there is already a Carbon Black File Reputation key showing in the Carbon Black File Reputation Activation box, skip to the next step. Otherwise, enter the key or contact your VMware Carbon Black Support representative to get an activation key.
    Note: Connectivity between the browser and the Carbon Black File Reputation site is required for the remainder of steps in this procedure.
  6. When a Carbon Black File Reputation key displays, click Activate. The Activation panel of the page is updated with new buttons.
  7. Click the Accept Terms and Activate button. The Carbon Black File Reputation Terms and Conditions page appears in a new browser window.
  8. Review the Carbon Black File Reputation terms and conditions. If you agree, select the check box to confirm that you have read the terms, and click the Submit button. This activates your subscription and enables you to connect to Carbon Black File Reputation.
  9. Close the Carbon Black File Reputation Activation browser window and return to System Configuration in the Carbon Black App Control Console.
  10. Click the Verify Activation button to determine whether Carbon Black File Reputation was successfully configured for communication with your Carbon Black App Control Server.
  11. Click the Options button, which displays after you complete the activation, to open a web page that allows modification of certain Carbon Black File Reputation parameters. The options include the following check boxes:
    • Enable file metadata sharing for Reputation and Threat results from Carbon Black File Reputation – This option enables transmission of file metadata (but not file content) collected from your agents to Carbon Black File Reputation for analysis. This option is enabled by default, and keeping it enabled is required for you to have access to the reputation services provided by Carbon Black File Reputation.
    • Enable remote diagnostic analysis by Carbon Black Support – This option enables transmission of diagnostic data and aggregate usage information from your Carbon Black App Control Server to be sent to Carbon Black on an ongoing basis to ensure optimal performance. This option is enabled by default.
    • Enable direct file transfer to Carbon Black Support for troubleshooting – This option allows any files placed in the Carbon Black App Control Server support directories to be sent to VMware Carbon Black Support, including log and agent cache files. This helps the support team respond to questions and issues that you report about your installation. This option is not enabled by default.
    • Enable automatic updates of Trusted Updaters and Advanced Threat Indicators – This option allows Carbon Black to remotely update or add trusted Updaters and advanced threat indicators (for detection) on your Carbon Black App Control Server. This option is enabled by default.
    • Enable Health Indicators – This option allows Carbon Black to remotely deliver Health Indicators, which monitor and report on the health of your Carbon Black App Control environment. It also allows updates to existing health indicators. This option is enabled by default. See Monitoring System Health for more details on this feature.
  12. Examine all of the Carbon Black File Reputation options. If you are unclear on what any option does, contact VMware Carbon Black Support for more information. When you know which options you want to enable or disable, click the Edit Settings button and select or deselect the check boxes. When you are finished, click the Save Settings button.
  13. To see the history of Carbon Black File Reputation configuration changes for your server, click the View Log link. When you are finished with this configuration, close the browser window.

Results

After integration with Carbon Black File Reputation is activated, synchronization of files on your server with the Carbon Black File Reputation server begins. To initiate a look up of specific files by hash in Carbon Black File Reputation, you can click the file View Carbon Black Reputation Data button on the File Details pages or select the same command from the Action menu on the Files table page. The analysis results for each file are displayed in a new browser tab. For multi-file requests in Internet Explorer, the popup blocker can block the results for each file after the first one.