Enter Credentials to Ingest Alerts from Carbon Black Cloud Data Forwarder (Optional)

To establish credentials to ingest Alerts using the Carbon Black Cloud Forwarder, perform the following procedure.

Continue after Step 6 of Create a ServiceNow Configuration Profile.

Prerequisites

• To ingest Alerts using the Carbon Black Cloud Forwarder, make sure that you have set up the Data Forwarder and ServiceNow MID server following the steps in Set up the Data Forwarder and MID Server for use with ServiceNow (Optional).
• Create a ServiceNow Configuration Profile

Procedure

1. For Alert Ingestion Approach, select Data Forwarder / AWS S3 Bucket.
2. Populate the following fields with information from Set up the Data Forwarder and MID Server for use with ServiceNow (Optional):
   • SQS Queue URL
   • Role ARN
   • Access Key
   • Access Secret
3. Select a Validated and Up MID server from the MID Server field.
4. Set the application scope to VMware Carbon Black Cloud. See also Configure the Scope for the Base ServiceNow App.
5. Configure the following settings based on the amount of data consumed from the SQS Queue:
   • MID server JVM Memory size from Set the MID Server JVM memory size
   • Number of MID server threads from Set MID Server Thread Use
6. Click Next.

Results

Note: Alerts from the S3 bucket will get ingested into ServiceNow even if those alerts have a different org_key than that of the configured profile.

What to do next

Configure Asset Inventory Data Ingestion (Optional)