Carbon Black Endpoint Standard

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Endpoint · Carbon Black Endpoint Standard

Configuration parameters

  • url — URL (required)
  • custom_credentials — Custom Api Key (using for API version 6)
  • live_response_credentials — Api Key (Api/Live Response key using for API version 3)
  • organization_key — Organization Key
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • suffix_url_path — The type of the alert
  • category — The category of the alert.
  • device_id — Device id
  • policy_id — Policy id
  • device_username — Device username
  • min_severity — Minimum severity
  • query — Query
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  • max_fetch — Maximum number of incidents per fetch

Commands (26)

  • cbd-add-rule-to-policy

    Adds a new rule to an existing policy. Note: System policies cannot be modified.

  • cbd-alerts-search

    Gets details on the events that led to an alert. This includes retrieving metadata around the alert as well as the event associated with the alert.

  • cbd-create-policy

    Creates a new policy on the CB Defense backend.

  • cbd-delete-policy

    Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.

  • cbd-delete-rule-from-policy

    Removes a rule from an existing policy. Note: System policies cannot be modified.

  • cbd-device-background-scan

    Starts a background scan on the device. Not supported for devices in a Linux operating system.

  • cbd-device-background-scan-stop

    Stops a background scan on the device. Not supported for devices in a Linux operating system.

  • cbd-device-bypass

    Bypasses a device.

  • cbd-device-policy-update

    Updates the devices to the specified policy ID.

  • cbd-device-quarantine

    Quarantines the device. Not supported for devices in a Linux operating system.

  • cbd-device-search

    Searches devices in your organization.

  • cbd-device-unbypass

    Unbypasses a device.

  • cbd-device-unquarantine

    Unquarantines the device. Not supported for devices in a Linux operating system.

  • cbd-device-update-sensor-version

    Updates the version of a sensor.

  • cbd-find-events

    Creates an enriched events search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, time_range) is required).

  • cbd-find-events-details

    Initiates a request to retrieve detail fields for enriched events. the job_id that returns from this command can be used to get the results using the "cbd-find-events-details-results" command.

  • cbd-find-events-details-results

    Retrieves the status for an enriched events detail request for a given job ID.

  • cbd-find-events-results

    Retrieves the result for an enriched events search request for a given job ID. By default returns 10 rows.

  • cbd-find-processes

    Creates a process search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, and time_range) is required.

  • cbd-find-processes-results

    Retrieves the results of a process search identified by the job ID.

  • cbd-get-alert-details

    Get details about the events that led to an alert by its ID. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.

  • cbd-get-policies

    Gets the list of policies available in your organization.

  • cbd-get-policy

    Retrieves a policy object by ID.

  • cbd-set-policy

    Resets policy fields.

  • cbd-update-policy

    Updates an existing policy with a new policy. Note: System policies cannot be modified.

  • cbd-update-rule-in-policy

    Updates an existing rule with a new rule. Note: System policies cannot be modified.