Carbon Black EDR
Endpoint detection & response (EDR) software
Endpoint protection software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if Carbon Black EDR and its alternatives fit your requirements.
Contact the product provider
Free Trial unavailableFree version unavailable
Small
Medium
Large
- Manufacturing
- Healthcare and life sciences
- Information technology and software
What is Carbon Black EDR
Carbon Black EDR is an endpoint detection and response platform that collects endpoint telemetry and provides threat hunting, detection, and incident response workflows. It is used by security operations teams to investigate suspicious activity, contain endpoints, and support forensic analysis across Windows, macOS, and Linux environments. The product emphasizes continuous endpoint visibility and query-based hunting over historical event data, typically deployed in organizations that need analyst-driven investigations and response.
Deep endpoint telemetry retention
The product captures detailed endpoint activity (process, file, network, and user context) to support investigations and retrospective analysis. This depth is useful for threat hunting and for reconstructing attack timelines. It aligns well with teams that need endpoint-centric forensics rather than only alert-driven triage.
Threat hunting and querying
Carbon Black EDR supports analyst-led hunting using queries over collected endpoint data. This enables proactive discovery of suspicious patterns that may not trigger standard detections. It is particularly valuable for mature SOCs that maintain hypotheses, playbooks, and custom detection logic.
Endpoint containment capabilities
The platform includes response actions that help limit attacker movement from an affected endpoint. These controls support incident response workflows by allowing analysts to take action without waiting for separate endpoint management tools. This can reduce time-to-containment during active investigations.
Operational complexity for small teams
The product’s value depends heavily on ongoing tuning, hunting, and analyst workflows. Organizations without dedicated security operations staff may struggle to operationalize it effectively. Teams looking for a more turnkey, managed experience may find the day-to-day overhead higher than expected.
EDR-first, broader platform gaps
Carbon Black EDR focuses on endpoint telemetry, investigation, and response rather than providing an all-in-one security operations platform. Buyers may still need separate tools for areas such as broader log/SIEM coverage, unified case management across sources, or extended cloud posture controls. This can increase integration and licensing complexity in multi-tool environments.
Licensing and packaging variability
Carbon Black capabilities are commonly packaged across multiple endpoint security offerings, which can make it harder to map requirements to the correct edition. Feature availability can vary by contract and bundle. This can complicate procurement comparisons and long-term cost forecasting.
Seller details
Broadcom Inc.
Palo Alto, California, USA
1961
Public
https://www.broadcom.com/
https://x.com/Broadcom
https://www.linkedin.com/company/broadcom/
