The Security Team here has licensed Carbon Black, and is trying to get it installed pretty much everwhere. Since the NSX-T nodes run Ubuntu Linux, they wanted us to install it on those. But - when we tried to install it, we noticed that we could not install the kernel headers (which it needs because it compiles kernel modules). So I presume VMWare does not want you installing packages on these nodes, or, in this case, agents such as Carbon Black.
But, since VMWare owns Carbon Black, I would have thought it would be inherently supported.