Carbon Black Defense Deprecated

Deprecated. Use Carbon Black Endpoint Standard instead.

Endpoint · Carbon Black Endpoint Standard

Configuration parameters

  • url — Server URL (e.g. https://192.168.0.1) (required)
  • key — API Key (required)
  • version — API Version (required)
  • connectorId — Connector ID (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • siemKey — SIEM key. Use to fetch incidents.
  • siemConnector — SIEM Connector ID. Use to fetch incidents.
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (16)

  • cbd-add-rule-to-policy

    Add a new rule to an existing policy. Please note that system policies cannot be modified.

  • cbd-change-device-status

    Change status of an individual device by its device ID. The requested security policy can be indicated either as a policy ID (policyId) or policy name (policyName).The current revision of the Cb Defense backend only allows one element to be changed with this call: the security policy assigned to the device. For example policyName=Restrictive_Windows_Workstation

  • cbd-create-policy

    Create a new Policy on the Cb Defense backend.

  • cbd-delete-policy

    Delete a policy from the Cb Defense backend. This may return an error if devices are actively assigned to the policy id requested for deletion. Please note that system policies cannot be deleted.

  • cbd-delete-rule-from-policy

    Removes a rule from an existing policy. Please note that system policies cannot be modified.

  • cbd-find-event

    Retrieve details for an individual event given the event ID

  • cbd-find-events

    Retrieves all events matching the input search criteria.

  • cbd-find-processes

    Find processes associated with a specific indicator or IP address filter. Only API keys of type “API” can call the processes API.

  • cbd-get-alert-details

    Get details on the events that led to an alert. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.

  • cbd-get-device-status

    Retrieve details for an individual device given the device ID.

  • cbd-get-devices-status

    Get a status of all devices. Optionally you can include a query parameter to filter the results. Combining these query parameters is an implicit “AND”.

  • cbd-get-policies

    Get the list of policies available in your organization.

  • cbd-get-policy

    Retrieve a policy object by ID.

  • cbd-set-policy

    Re-set policy fields.

  • cbd-update-policy

    Update an existing policy with a new policy. Please note that system policies cannot be modified.

  • cbd-update-rule-in-policy

    Update an existing rule with a new rule. Please note that system policies cannot be modified.