---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Carbon Black - Incident Enrichment integration

# Carbon Black - Incident Enrichment integration {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the Carbon Black integration to investigate and respond to security incidents using
APIs to query and interact with endpoints associated with security incidents.

## Find Carbon Black- Incident Enrichment integration resources {#carbon-blk-inc-enrich-landing-page__section_lcp_b1b_qdb}

* [Get started with the Carbon Black - Incident Enrichment integration](https://www.servicenow.com/docs/P~7e47MFvrNMA0wmlpv4Jw "The Carbon Black incident enrichment facilitates the investigation of a security incident by querying logs for potentially malicious indicators. Before you can use the Carbon Black - Incident Enrichment integration, you must download it from the ServiceNow Store and add the appropriate Endpoint Base URL and MID server.")
* [Security Operations Carbon Black Integration - Get Running Processes Flow](https://www.servicenow.com/docs/2LNHlOTqsJ_V~4W7_VBByQ "The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process flow.")
* [Security Operations Carbon Black Integration - Isolate Host Flow](https://www.servicenow.com/docs/TRE0lRhe5zs60Ta~9cXwxw "The Security Operations Carbon Black Integration - Isolate Host is the implementation for the Carbon Black integration launched by the Security Operations Integration - Isolate Host flow.")
* [Security Operations Carbon Black Integration- Remove Host Isolation Flow](https://www.servicenow.com/docs/wrQWRLUN~EGYi88~acA6Ug "The Security Operations Carbon Black Integration - Remove Host Isolation flow unblocks communication with a specified host or endpoint in a Carbon Black system.")
{#carbon-blk-inc-enrich-landing-page__ul_o3n_d1b_qdb}

## Understand integration concepts {#carbon-blk-inc-enrich-landing-page__section_cmg_tz1_qdb}

[Types of ServiceNow integrations provided](https://www.servicenow.com/docs/~UySGMI5h5EkEJS9syXtRw "The Security Operations applications (Security Incident Response, Threat Intelligence, and Vulnerability Response) can be seamlessly integrated with other ServiceNow applications to enhance their functionality.")

## Get help from ServiceNow
resources {#carbon-blk-inc-enrich-landing-page__section_gld_21b_qdb}

* [Ask or answer questions in the Security Operations community](https://community.servicenow.com/community/security-operations)
* [Search the Known Error Portal for known error articles](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0597477)
* [Contact Customer Service and Support](https://support.servicenow.com/now?draw=case)
* [Upgrade to Madrid](https://www.servicenow.com/docs/access?context=upgrade&version=brazil&pubname=brazil-release-notes&ft:locale=en-US)
{#carbon-blk-inc-enrich-landing-page__ul_wzr_h1b_qdb}