Use the Asset Inputs tab to configure inputs to pull Assets by using the Carbon Black Cloud APIs.
The Asset input uses the Carbon Black Cloud Asset Group API, Carbon Black Cloud Device API, and Carbon Black Cloud Device Control API.
Note: USB Devices require
Carbon Black Cloud Endpoint Standard to access this data.
| Setting | Description |
|---|---|
| Name | Used to distinguish between inputs. |
| Active | A checkbox enables or disables the input. |
| API Token | The API Key from the API Token Configuration tab to use for the API authorization. For required permissions, see API Data Inputs. |
| Proxy | The proxy configuration, if needed. |
| Lookback | The number of historical days to pull from the API on initial configuration. |
| Index | The Splunk Index in which to store the data.
Note: This value must match value of the
VMware Base Index on the
VMware Base Configuration tab.
|
| Interval | The frequency that the API should poll for data. Options: Once daily, Twice Daily, Weekly (first of the week), and Monthly (first of the month). |
| Interval Hour | The hour of the day that the API should poll for data. |
| Deregistered | Indicates whether deregistered devices should be retrieved. |
| Asset Types | The types of assets to be retrieved. Options: Asset Groups, AWS, Azure, Endpoints, GCP, USB Devices, VDI Clones, and VM Workloads. |
