Carbon Black EDR operations in the single-cluster context of Carbon Black EDR Unified View are mostly the same as when logged directly into a standalone instance of Carbon Black EDR, with noted exceptions.

On the Cluster Management page in Carbon Black EDR Unified View, click Browse Cluster to open a new browser tab that displays the cluster’s HUD page. In this view, no multi-context operations are available.

Single-cluster context is also initiated when you click the cluster name on certain pages. In the single-cluster context of Carbon Black EDR Unified View, clicking the logo at the top of the left navigation bar displays the cluster’s HUD page instead of the Cluster Management page.

Operating Exclusions

You cannot perform the following actions in the single-cluster context of Carbon Black EDR Unified View:
  • Log out of Carbon Black EDR on the cluster. The Logout command is unavailable in the single-cluster context of Carbon Black EDR Unified View because authentication to the cluster is through a shared or individual API token, not a username and password.
  • Modify your cluster user profile.
  • Request email notifications for threat intelligence hits.
  • Request email notifications for watchlist hits.

To perform these actions on a single cluster, you must log directly into that instance.

Features Limited by User Permissions

Some features are limited by the permissions of the user whose API token authenticates a cluster’s connection to Carbon Black EDR Unified View.

  • If the user's token is from a global administrator for the cluster, Carbon Black EDR Unified View, the user has privileges for all cluster console features that Carbon Black EDR Unified View does not explicitly exclude.
  • If the user's token is from a non-administrator user for the cluster and that user is limited to accessing only some sensor groups, the Carbon Black EDR Unified View user is similarly limited when using Browse Cluster.
  • If the user's token is from a non-administrator user for the cluster, and that user is only allowed to view data but not take actions that affect the cluster or its sensors, the Carbon Black EDR Unified View is limited when using Browse Cluster.

See the Carbon Black EDR User Guide for information about user permissions.