EDR Tools: Getting the Most Value Out Of Carbon Black EDR

This guidance document describes four practical recommendations to maximize value from a VMware Carbon Black EDR deployment: (1) map the environment and build relationships with key personnel to understand normal versus anomalous behavior; (2) reduce false positives through a five-step tuning process and custom watchlists; (3) leverage Carbon Black APIs for automation, sensor health monitoring, and out-of-band checks; and (4) use the Carbon Black User Exchange for troubleshooting, community threat intelligence, and custom search queries. The piece also highlights integrating ReliaQuest GreyMatter to automate responses and improve endpoint visibility, and claims an average 78% reduction in EDR alert volume for customers.