Carbon Black EDR Unified View provides a single interface for process and binary searches across multiple Carbon Black EDR clusters, returning a unified set of results.

From the search results, you can drill down to process analysis and binary details pages. You also can open a connection to a single Carbon Black EDR instance, which might be a single server or a cluster of servers.

Note:

To simplify presentation in this document, all Carbon Black EDR instances that Carbon Black EDR Unified View accesses are described as “clusters,” but the information provided is valid for single-server instances as well.

The Carbon Black EDR Unified View server has its own user store, and a configuration store for the servers it queries. However, it does not store any of the queried data on the server.

There are two types of user in Carbon Black EDR Unified View: administrators and non-administrators. A Carbon Black EDR Unified View administrator can determine which of the available Carbon Black EDR clusters to include in the Carbon Black EDR Unified View deployment and also create and manage user accounts on the Carbon Black EDR Unified View server.

Connections between Carbon Black EDR Unified View and the clusters from which it draws are accomplished using API keys for user accounts on each cluster.

Note:

Carbon Black EDR Unified View does not support Live Query.