Carbon Black EDR Unified View runs on a separate server from the Carbon Black EDR clusters it manages. It provides a graphical front end that does the following:

  • Manages queries to the Carbon Black EDR Unified View server
  • Runs those queries against each configured Carbon Black EDR cluster
  • Merges the results into a unified set

The following figure illustrates the architecture of a Carbon Black EDR Unified View deployment, which uses a modified version of the Carbon Black EDR user interface.

cbr-unifiedview-overview