External Alert configuration error (VMware Carbon Black Endpoint Standard)

Issue

An error is being displayed for the VMware Carbon Black Endpoint Standard (Formerly Cb Defense) Alert Source that states:

We weren't able to retrieve alerts because of a configuration error. Please check your configuration.

Environment

Red Canary Alert Source Configuration

Resolution

Generate new credentials in the VMware Carbon Black Cloud console and update the alert source in Red Canary.

1. Log into your VMware Carbon Black Cloud console (make note of the URL for accessing the console as this will be needed for a later step).
2. Click Settings > API Access (make note of the ORG KEY and ORG ID at the top of the page; this information will be needed for a later step).
3. Click the Access Levels tab.
4. Create a new Access Level named Red Canary Alert Center with description This access level is used by Red Canary to retrieve alerts for validation and investigation.
5. Allow permissions for CREATE, READ and DELETE under org.alerts.notes.
6. Allow permissions for READ under org.alerts.
7. Allow permissions for EXECUTE under org.alerts.dismiss.
8. Click Save.
9. Click the API Keys tab.
10. Click Add API Key and set the following values:
    1. Name: red_canary_alert_center
    2. Access Level: Custom
    3. Custom Access Level: Red Canary Alert Center
    4. Description: This API key is used by Red Canary to retrieve alerts for validation and investigation.
11. Click Save.
12. Annotate the API ID and API Secret Key that appear on the screen (note: copy and paste the values into a separate text document to ensure that the correct spacing is captured).
13. Log into Red Canary and go to Alert Sources.
14. Begin to type in VMware Carbon Black Endpoint Standard and select the product when it appears under the query box.
15. Select the newly added alert source.
16. Click Configure.
17. Choose Vmware Cb Cloud via API Poll as the Ingest Format/Method.
18. Enter the following information into the fields:
    1. API URL: (this will be the first portion of the URL e.g. https://defense-prod05.conferdeploy.net)
    2. Enter the Org Key and Org Id values that were copied in step 5.
    3. Enter the API Id and API Secret Key that were copied in step 15.
19. Click Save.
20. Click Activate it to begin processing alerts (you may see an additional error message appear in regard to retrieving alerts; this should clear up after 5-10 minutes. If it does not go away, please contact Support).

Cause

Creating these API credentials for the sole purpose of managing native alerts in the VMware Carbon Black console is necessary in order to resolve this issue.