As of January 31st, 2022 the APIs the app is consuming will be decomissioned causing some features to no longer function.
This app is no longer supported. Migrate to the VMware Carbon Black Cloud App for Splunk (https://splunkbase.splunk.com/app/5332/).
The VMware Carbon Black Cloud Enterprise EDR App for Splunk allows a Splunk Administrator to connect to and pull notifications from the VMware Carbon Black Cloud, with a focus on Enterprise EDR information.
Note: VMware Carbon Black Cloud users should upgrade to our unified app to access the latest features and support. Download the VMware Carbon Black Cloud App for Splunk (https://splunkbase.splunk.com/app/5332/).