To configure when or how often data is collected from Carbon Black Cloud, perform the following procedure.

Continue after Step 8 of Configure Alert Field Mapping for ITSM and SecOps Apps.

There are two settings that can be configured:

  • Recurring Data Collection - for periodic ingestion of alerts; normal running
  • One-Time Data Collection - for example, to populate recent data on initial setup or to fill in a missing period of data
Note:
  • This feature is only supported when alerts are ingested by using the API. It is not supported for the Carbon Black Cloud Data Forwarder ingestion method.
  • To change this configuration after the initial setup, go to VMware Carbon Black Cloud > Configurations and click Scheduling.

Prerequisites

Create a ServiceNow Configuration Profile

Procedure

  1. Select the Recurring data collection checkbox.
  2. Enter a time interval in seconds.
  3. Provide the Collection Start Time from the calendar. The collection start date must be a future date or within 15 days prior to the current date.

    Collection Start Time calendar from which to select a start date

  4. Optional: To configure alert data ingestion for a bounded window in the past, select the One-Time Collection checkbox.
    1. Provide the Collection Start Time from the calendar. Only past dates and times or the current time minus 15 days are acceptable.
    2. Provide the date and time for the Collection End Time.
  5. Click Finish.
    A popup window warns that the profile is inactive and allows you to activate the profile or save the profile as inactive.

    If you save your configuration profile as inactive, you can activate it later. See Activate a Configuration Profile.

Results

The Alert page will be populated based on the frequency that Alerts are created in Carbon Black Cloud and the ingest scheduling in ServiceNow.