Carbon Black EDR

Broadcom Carbon Black EDR (formerly CB Response) is an industry-standard, on-premises endpoint detection and response and incident investigation platform designed for security operations centers, incident response teams, and organizations with strict data sovereignty mandates. Purpose-built to provide granular, unfiltered endpoint visibility, Carbon Black EDR continuously captures, records, and stores complete kernel-level telemetry—including every process execution, file modification, network connection, cross-process memory access, and registry change—across the entire enterprise fleet.

The platform provides threat hunters and forensic analysts with an exhaustive timeline of endpoint activity, allowing them to travel back in time to reconstruct the exact progression of advanced persistent threat (APT) campaigns, zero-day compromises, and lateral movements. Key capabilities include high-speed historical search across massive volumes of raw endpoint event logs, customizable behavioral attack heuristics, automated threat feed ingestion, remote live incident response shell for forensic acquisition and file quarantine, and network isolation of compromised hosts. Because the management and data indexing infrastructure can be hosted fully on-premises or in an air-gapped private cloud, sensitive forensic data never leaves the corporate boundary.

Carbon Black EDR integrates deeply with leading SIEM, SOAR, and threat intelligence ecosystems, including Splunk, IBM QRadar, Palo Alto Networks Cortex XSOAR, and MITRE ATT&CK mappings. Primary enterprise use cases include executing complex malware forensic investigations, conducting proactive APT threat hunting, performing enterprise breach scoping, and satisfying stringent compliance and data residency requirements in defense, intelligence, and banking sectors. Carbon Black EDR remains a foundational tool for advanced incident response.