Environment
- Carbon Black Cloud console
- Endpoint Standard
- Enterprise EDR
- Carbon Black EDR server (On-Prem): 7.2 and above
- VMware Carbon Black Cloud App for Splunk: 1.x
- VMware Carbon Black EDR On-Prem for Splunk: 3.0.1
- Splunk: 8.x
Symptoms
Events generated by the EDR (On-Prem) product appear in the Carbon Black Cloud Splunk app
Cause
Inter-operability issue between Carbon Black Cloud and EDR (On-Prem) Splunk apps
Resolution
This issue will be fixed in a future release of the VMware Carbon Black Cloud App for Splunk
