Skip to main content
The BlueApp for VMware Carbon Black Cloud provides a set of orchestration actions that you can use in your USM Anywhere environment. The following table lists the available actions from the BlueApp. Actions for the BlueApp for VMware Carbon Black Cloud
ActionDescription
Unquarantine Devices from RuleThis action unquarantines a VMware Carbon Black device from a rule.
Update Policy from RuleThis action updates a Carbon Black Cloud policy to a new policy from a rule.
Create a Note for an AlertThis action creates or deletes a note for an alert from an event, alarm, or rule.
Disable Bypass of DeviceThis action disables the bypass of a VMware Carbon Black device from an event or alarm.
Quarantine DevicesThis action quarantines a specified device from an event or alarm.

This action is not available on devices running a Linux operating system.
Create a Note for ThreatThis action creates a note for a threat from an event, alarm, or rule.
Delete a Note from a ThreatThis action deletes a note for a threat from an event or alarm.
Update Tags from RuleThis action adds tags to a threat from a rule.
Enable Bypass of DeviceThis action enables the bypass of a VMware Carbon Black device from an event or alarm.
Disable Bypass from RuleThis action disables the bypass of a VMware Carbon Black device from a rule.
Quarantine Devices from RuleThis action quarantines VMware Carbon Black devices from a rule.
Enable Bypass from RuleThis action enables the bypass of a VMware Carbon Black device from a rule.
Unquarantine DevicesThis action unquarantines a specified quarantined device from an event or alarm.

This action is not available on devices running a Linux operating system.
Delete a Note from an AlertThis action deletes a note for an alert from an event or alarm.
Update TagsThis action adds tags to a threat from an event or alarm.
Update PolicyThis action moves VMware Carbon Black device to a new policy from an event or alarm.
Delete a TagThis action deletes a tag for a threat from an event or alarm.
To view information about these actions in USM Anywhere
  1. In USM Anywhere, go to Data Sources > BlueApps.
  2. Click the Available Apps tab.
  3. Search for the BlueApp, and then click the tile.
  4. Click the Actions tab to display information for the supported actions.
  5. Click the History tab to display information about the executed orchestration actions.

​
Launch Actions from Alarms and Events

You can launch an action directly from alarms or events. If you want to apply an action to similar events that occur in the future, you can also create orchestration rules directly from the action applied to an alarm or an event. To launch a Carbon Black Cloud response action for an Alarm or Event
  1. Go to Activity > Alarms or Activity > Events.
  2. Click the alarm or event to open the details.
  3. Click Select Action.
  4. In the Select Action dialog box, select Run Carbon Black Cloud Action.
  5. Select the app action and fill out the fields that are populated below.
  6. Click Run. After USM Anywhere initiates the action for an alarm or event, it displays a confirmation dialog box. If you want to create a rule to apply the action to similar items that occur in the future, click Create rule for similar alarms or Create rule for similar events and define the new rule. If not, click OK.
⌘I