---
title: Carbon Black
description: Integrate events and alerts from VMware Carbon Black NGAV and EDR.
breadcrumbs: Docs > Integrations > Carbon Black
---

# Carbon Black

## Overview{% #overview %}

Use the Datadog-Carbon Black integration to forward your Carbon Black EDR events and alerts as Datadog logs.

## Setup{% #setup %}

### Installation{% #installation %}

Datadog uses Carbon Black's event forwarder and Datadog's Lambda forwarder to collect Carbon Black events and alerts from your S3 bucket.

Carbon Black provides a [Postman collection](https://documenter.getpostman.com/view/7740922/SWE9YGSs?version=latest) for the API that you use to create the Carbon Black event forwarder.

#### Configuration{% #configuration %}

1. [Install the Datadog Forwarder](https://app.datadoghq.com/serverless/libraries_integrations/forwarder/).
1. [Create a bucket in your AWS Management Console](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#create-a-bucket) to forward events to.
1. [Configure the S3 bucket to allow the Carbon Black forwarder to write data](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#configure-bucket-to-write-events).
1. [Create an access level in the Carbon Black Cloud console](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#create-access-level).
1. [Create an API key in the Carbon Black Cloud console](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#create-new-api-key).
1. [Configure the API in Postman](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#configure-api-in-postman) by updating the value of the following Postman environment variables with the key created above: `cb_url`, `cb_org_key`, `cb_custom_id`, and `cb_custom_key`.
1. [Create two Carbon Black event forwarders](https://community.carbonblack.com/t5/Developer-Relations/Carbon-Black-Cloud-Data-Forwarder-Quick-Setup-amp-S3-Bucket/td-p/89194#create-new-forwarder) with different names for Carbon Black alerts (`"type": "alert"`) and endpoint events (`"type": "endpoint.event"`).
1. [Set up the Datadog Forwarder to trigger on the S3 bucket](https://app.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function/?tab=awsconsole#collecting-logs-from-s3-buckets).

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://app.datadoghq.com/help/).