Features when Servers are Integrated

Additional Carbon Black EDR-to-Carbon Black App Control integration features become available when you explicitly configure two servers to work with each other.

Most of these features involve making information from and about Carbon Black EDR available in the Carbon Black App Control console:

• Carbon Black EDR Sensor Details in the App Control Console – Pages displaying details about a computer that is running the Carbon Black App Control agent show whether the Carbon Black EDR sensor is installed, and if so, the version and status of the sensor (for Windows agents only).
• Carbon Black EDR File Statistics in App Control Console – Details about a file on a computer running the Carbon Black App Control agent show Carbon Black EDR statistics about the file — such as how many watchlists it is on, the number of computers and processes in which the file has been seen, and the number of network connections.
• Links to the Carbon Black EDR server in the App Control Console – Menu and inline links from the Carbon Black App Control console Events table, Computer Details, and File Details pages connect to the Carbon Black EDR data for the object that is being viewed.
• App Control Agent Status in the Carbon Black EDR Console – The Host Information page for each computer running a sensor reports whether a Carbon Black App Control agent is installed.
• Process Data Correlation – A globally unique process identifier called a Process Key shows when events on a Carbon Black EDR server and a Carbon Black App Control server are referencing the same process. It uniquely identifies an individual instance of the running process. This identifier is available in Syslog output, and as data that is exported for third-party analysis tools such as Splunk.

See App Control Console for more details on integration features.