What Changed

The VMware Carbon Black Cloud CCF connector (v3.0.9) fixes a type mismatch between the data the Carbon Black API delivers and the types declared in the DCR stream schema. The mismatch affected two streams:

Alerts stream (Custom-CarbonBlack_Alerts_CL)

  • severity: declared string in DCR, API delivers int – corrected to int in schema; tostring(severity) added to transformKql to match the string output table column.
  • process_pid / parent_pid: declared string, API delivers long – corrected to long in schema; tostring(process_pid) / tostring(parent_pid) added to transformKql.

Watchlist stream (Custom-CarbonBlack_Watchlist_CL)

  • Same corrections applied to severity, process_pid, and parent_pid.

Both the CarbonBlackViaAWSS3_ConnectorDefinition.json and the standalone CarbonBlack_DCR.json were updated with identical changes, covering both the AWS S3 and direct CCF ingestion paths.

Security Impact (Visibility and Fidelity)

Deployments running v3.0.8 or earlier had a type mismatch in the DCR. A DCR schema type mismatch against the incoming stream causes transformation errors at ingest time – the practical result is corrupted or null data in the CarbonBlack_Alerts_CL and CarbonBlack_Watchlist_CL tables for the affected fields.

Queries filtering on Severity, ProcessPid, or ParentPid in these tables returned null or failed to match for all rows on affected deployments – this is a data fidelity gap, not a cosmetic fix.

After upgrading to v3.0.9, redeploy or update the DCR to apply the corrected schema; existing historical rows with null PID or severity values will not be backfilled.

Affected Files

Solutions/VMware Carbon Black Cloud/Data Connectors/CarbonBlackViaAWSS3_ConnectorDefinition.json
Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DCR.json
(packaging artefacts: 3.0.9.zip, ReleaseNotes.md, Solution_VMware Carbon Black Cloud.json, mainTemplate.json)