Carbon Black Endpoint Standard
Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.
Endpoint · Carbon Black Endpoint Standard
Details
| ID | Carbon Black Endpoint Standard |
|---|---|
| Provider | Broadcom |
| Category | Endpoint |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
VMware Carbon Black Endpoint Standard (formerly known as Carbon Black Defense) is a next-generation antivirus + EDR in one cloud-delivered platform that stops commodity malware, advanced malware, non-malware attacks, and ransomware.
This integration was integrated and tested with version 1.1.2 of Carbon Black Endpoint Standard
New Features in Carbon Black Endpoint Standard v2
The Carbon Black Endpoint Standard v1 integration is deprecated because Carbon Black released a new version of their API. Use the Carbon Black Endpoint Standard v2 integration instead. The following are the new features in V2.
New Commands
The Carbon Black Endpoint Standard v2 integration supports the following new commands:
- Operations on devices:
- cbd-device-background-scan Starts a background scan on a device by ID.
- cbd-device-background-scan-stop Stops a background scan on a device by ID.
- cbd-device-bypass Bypasses a device.
- cbd-device-unbypass Unbypasses a device.
- cbd-device-policy-update Updates the devices to the specified policy ID.
- cbd-device-update-sensor-version Updates the version of a sensor.
- cbd-device-quarantine Quarantines the device.
- cbd-device-unquarantine Unquarantines the device.
- cbd-alerts-search Retrieves all alerts using some arguments (query, ID, type, category) to filter the results.
- cbd-find-events-details Retrieves details for enriched events.
- cbd-find-events-details-results Retrieves the status for an enriched events detail request for a given job ID.
- cbd-find-events-results Retrieves the result for an enriched events search request for a given job ID.
- cbd-find-processes-results Retrieves the results of a process search identified by the job ID.
Deprecated Commands in Carbon Black Endpoint Standard v1
The following commands from the Carbon Black Endpoint Standard v1 integration have been deprecated and replaced with the v2 commands as shown.
| Deprecated Command | Replaced with v2 Commands |
|---|---|
| cbd-get-device-status | cbd-device-search |
| cbd-get-devices-status | cbd-device-search |
| cbd-change-device-status | - cbd-device-quarantine - cbd-device-unquarantine - cbd-device-background-scan - cbd-device-background-scan-stop - cbd-device-bypass - cbd-device-unbypass - cbd-device-policy-update - cbd-device-update-sensor-version |
| cbd-find-events | cbd-find-events returns a job_id to use in the cbd-find-events-results command as an argument. |
| cbd-find-processes | cbd-find-processes returns a job_id to use in the cbd-find-processes-results command as an argument. |
Playbooks
There are 3 new playbooks:
- Carbon Black Endpoint Standard Find Events - Finds events using a search query (or device_id, etc.).
- Carbon Black Endpoint Standard Find Event Details - Receives event IDs and returns details about the event.
- Carbon Black Endpoint Standard Find Processes - Finds processes using a search query (or device_id, etc.).
Mapper
Carbon Black Endpoint Standard Mapper.
Layout
Carbon Black Endpoint Standard Incoming Layout.
Classifier
Carbon Black Endpoint Standard
Configure Carbon Black Endpoint Standard in Cortex
| Parameter | Description | Required |
|---|---|---|
| URL | True | |
| Custom API Key | This Custom API key is required for all use cases except the policy use cases. | False |
| Custom API Secret Key | This Custom API secret key is required for all use cases except the policy use cases. | False |
| Live Response API Key | This Live Response API key is required only for the policy use cases. | False |
| Live Response API Secret Key | This Live Response API secret key is required only for the policy use cases. | False |
| Organization Key | The organization unique key. This is required for all use cases (and for fetching incidents) except the policy use cases. | False |
| Incident type | False | |
| Fetch incidents | False | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| The type of the alert | Type of alert to be fetched. | False |
| The category of the alert. | Category of alert to be fetched (THREAT, MONITORED). If nothing is selected he is fetching from all categories. | False |
| Device id | The alerts related to a specific device, represented by its ID. | False |
| Policy id | The alerts related to a specific policy, represented by its ID. | False |
| Device username | The alerts related to a specific device, represented by its username. | False |
| Query | Query in Lucene syntax and/or value searches. | False |
| First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). | False | |
| Maximum number of incidents per fetch | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cbd-get-alert-details
Get details about the events that led to an alert by its ID. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
Required Permissions
RBAC Permissions Required - org.alerts: READ
Base Command
cbd-get-alert-details
Input
| Argument Name | Description | Required |
|---|---|---|
| alertId | The ID of the alert. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Alert.id | String | The identifier for the alert. |
| CarbonBlackDefense.Alert.legacy_alert_id | String | The unique short ID for the alerts to support easier consumption in the UI console. Use the ID for API requests. |
| CarbonBlackDefense.Alert.org_key | String | The unique identifier for the organization associated with the alert. |
| CarbonBlackDefense.Alert.create_time | Date | The time the alert was created. |
| CarbonBlackDefense.Alert.last_update_time | Date | The last time the alert was updated. |
| CarbonBlackDefense.Alert.first_event_time | Date | The time of the first event associated with the alert. |
| CarbonBlackDefense.Alert.last_event_time | Date | The time of the latest event associated with the alert. |
| CarbonBlackDefense.Alert.threat_id | String | The identifier of the threat that this alert belongs to. Threats are comprised of a combination of factors that can be repeated across devices. |
| CarbonBlackDefense.Alert.severity | Number | The threat ranking of the alert. |
| CarbonBlackDefense.Alert.category | String | The category of the alert (THREAT, MONITORED). |
| CarbonBlackDefense.Alert.device_id | Number | The identifier assigned by Carbon Black Cloud to the device associated with the alert. |
| CarbonBlackDefense.Alert.device_os | String | The operating system of the device associated with the alert. |
| CarbonBlackDefense.Alert.device_os_version | String | The operating system and version on the device. |
| CarbonBlackDefense.Alert.device_name | String | The hostname of the device associated with the alert. |
| CarbonBlackDefense.Alert.device_username | String | The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner. |
| CarbonBlackDefense.Alert.policy_id | Number | The identifier for the policy associated with the device at the time of the alert. |
| CarbonBlackDefense.Alert.policy_name | String | The name of the policy associated with the device at the time of the alert. |
| CarbonBlackDefense.Alert.target_value | String | The priority of the device assigned by the policy. |
| CarbonBlackDefense.Alert.workflow.state | String | The state of the tracking system for alerts as they are triaged and resolved. The state can be OPEN or DISMISSED. |
| CarbonBlackDefense.Alert.workflow.remediation | String | The state of the workflow of the tracking system for alerts as they are triaged and resolved. The state can be OPEN or DISMISSED. |
| CarbonBlackDefense.Alert.workflow.last_update_time | Date | The last time the alert was updated. |
| CarbonBlackDefense.Alert.workflow.comment | String | The comment about the workflow of the tracking system for alerts as they are triaged and resolved. |
| CarbonBlackDefense.Alert.workflow.changed_by | String | The name of the person who changed the alert. |
| CarbonBlackDefense.Alert.notes_present | Boolean | Indicates if notes are associated with the threat ID. |
| CarbonBlackDefense.Alert.tags | Unknown | Tags associated with the alert ([ “tag1”, “tag2” ]). |
| CarbonBlackDefense.Alert.reason | String | The description of the alert. |
| CarbonBlackDefense.Alert.count | Number | The count of the alert. |
| CarbonBlackDefense.Alert.report_id | String | The identifier of the report that contains the IOC. |
| CarbonBlackDefense.Alert.report_name | String | The name of the report that contains the IOC. |
| CarbonBlackDefense.Alert.ioc_id | String | The identifier of the IOC that caused the hit. |
| CarbonBlackDefense.Alert.ioc_field | String | The indicator of comprise (IOC) field that the hit contains. |
| CarbonBlackDefense.Alert.ioc_hit | String | IOC field value or IOC that matches the query. |
| CarbonBlackDefense.Alert.watchlists.id | String | The ID of the watchlists associated with an alert. |
| CarbonBlackDefense.Alert.watchlists.name | String | The name of the watchlists associated with an alert. |
| CarbonBlackDefense.Alert.process_guid | String | The global unique identifier of the process that triggered the hit. |
| CarbonBlackDefense.Alert.process_name | String | The name of the process that triggered the hit. |
| CarbonBlackDefense.Alert.run_state | String | The run state for the watchlist alerts. This value is always “RAN”. |
| CarbonBlackDefense.Alert.threat_indicators.process_name | String | The name of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_indicators.sha256 | String | The SHA-256 hash of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_indicators.ttps | String | The tactics, techniques, and procedures (TTPs) of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_cause_actor_sha256 | String | The SHA-256 hash of the threat cause actor. |
| CarbonBlackDefense.Alert.threat_cause_actor_md5 | String | The MD5 hash of the threat cause actor. |
| CarbonBlackDefense.Alert.threat_cause_actor_name | String | Process name or IP address of the threat actor. |
| CarbonBlackDefense.Alert.threat_cause_reputation | String | The reputation of the threat cause. (KNOWN_MALWARE, SUSPECT_MALWARE, PUP, NOT_LISTED, ADAPTIVE_WHITE_LIST, COMMON_WHITE_LIST, TRUSTED_WHITE_LIST, COMPANY_BLACK_LIST). |
| CarbonBlackDefense.Alert.threat_cause_threat_category | String | The category of the threat cause. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.threat_cause_vector | String | The source of the threat cause. (EMAIL, WEB, GENERIC_SERVER, GENERIC_CLIENT, REMOTE_DRIVE, REMOVABLE_MEDIA, UNKNOWN, APP_STORE, THIRD_PARTY). |
| CarbonBlackDefense.Alert.document_guid | String | The document GUID. |
| CarbonBlackDefense.Alert.type | String | The type of alert. (CB_ANALYTICS, DEVICE_CONTROL). |
| CarbonBlackDefense.Alert.reason_code | String | The shorthand enum for the full-text reason. |
| CarbonBlackDefense.Alert.device_location | String | Whether the device was on-premise or off-premise when the alert started. (ONSITE, OFFSITE, UNKNOWN). |
| CarbonBlackDefense.Alert.created_by_event_id | String | Event identifier that initiated the alert. |
| CarbonBlackDefense.Alert.threat_activity_dlp | String | Whether the alert involved data loss prevention (DLP). (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_activity_phish | String | Whether the alert involved phishing. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_activity_c2 | String | Whether the alert involved a command and control (c2) server. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_cause_actor_process_pid | String | The process identifier (PID) of the actor process. |
| CarbonBlackDefense.Alert.threat_cause_process_guid | String | The GUID of the process. |
| CarbonBlackDefense.Alert.threat_cause_parent_guid | String | The parent GUID of the process. |
| CarbonBlackDefense.Alert.threat_cause_cause_event_id | String | The threat cause cause event ID. |
| CarbonBlackDefense.Alert.blocked_threat_category | String | The category of the threat on which we were able to take action. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.not_blocked_threat_category | String | Other potentially malicious activity involved in the threat on which we weren’t able to take action (either due to policy config, or not having a relevant rule). (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.kill_chain_status | String | The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. (RECONNAISSANCE, WEAPONIZE, DELIVER_EXPLOIT, INSTALL_RUN, COMMAND_AND_CONTROL, EXECUTE_GOAL, BREACH). For example [ “EXECUTE_GOAL”, “BREACH” ]. |
| CarbonBlackDefense.Alert.sensor_action | String | The action taken by the sensor, according to the rule of the policy. (POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY). |
| CarbonBlackDefense.Alert.policy_applied | String | Whether a policy was applied. (APPLIED, NOT_APPLIED). |
Command Example
!cbd-get-alert-details alertId=3d541e1d-8930-4651-85c3-8cd9728d9776
Context Example
{
"CarbonBlackDefense": {
"Alert": {
"category": "THREAT",
"count": 0,
"create_time": "2021-04-04T10:42:54.143Z",
"device_id": 5678,
"device_name": "AB\\winABCL-1234",
"device_os": "WINDOWS",
"device_os_version": null,
"device_username": "jon@example.com",
"document_guid": "1a2b3c4d",
"first_event_time": "2021-04-04T10:39:55.946Z",
"id": "1234",
"ioc_field": null,
"ioc_hit": "((netconn_port:5355 device_os:WINDOWS)) -enriched:true",
"ioc_id": "565633-0",
"last_event_time": "2021-04-04T10:39:55.946Z",
"last_update_time": "2021-04-04T10:42:54.143Z",
"legacy_alert_id": "ABCD-1234",
"notes_present": false,
"org_key": "7DESJ9GN",
"policy_id": 6525,
"policy_name": "default",
"process_guid": "7DESJ9GN-003e6d59-00000498-00000000-1d70b726e2c3359",
"process_name": "svchost.exe",
"reason": "Process svchost.exe was detected by the report \"Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected\" in watchlist \"ATT&CK Framework\"",
"report_id": "ABCD-1234",
"report_name": "Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected",
"run_state": "RAN",
"severity": 1,
"tags": null,
"target_value": "LOW",
"threat_cause_actor_md5": "36f670d89040709013f6a460176767ec",
"threat_cause_actor_name": "c:\\windows\\system32\\svchost.exe",
"threat_cause_actor_sha256": "438b6ccd84f4dd32d9684ed7d58fd7d1e5a75fe3f3d12ab6c788e6bb0ffad5e7",
"threat_cause_reputation": "TRUSTED_WHITE_LIST",
"threat_cause_threat_category": "UNKNOWN",
"threat_cause_vector": "UNKNOWN",
"threat_id": "8E4CE676E9C9EEF4F94065D009B66094",
"threat_indicators": [
{
"process_name": "svchost.exe",
"sha256": "1a2b3c4d",
"ttps": [
"565633-0"
]
}
],
"type": "WATCHLIST",
"watchlists": [
{
"id": "1234",
"name": "ATT&CK Framework"
}
],
"workflow": {
"changed_by": "Carbon Black",
"comment": null,
"last_update_time": "2021-04-04T10:42:05.900Z",
"remediation": null,
"state": "OPEN"
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Get Alert Details
Id Category Device Id Device Name Device Username Create Time Ioc Hit Policy Name Process Name Type Severity 1234 THREAT 5678 AB\winABC-123 jon@example.com 2021-04-04T10:42:54.143Z ((netconn_port:5355 device_os:WINDOWS)) -enriched:true default svchost.exe WATCHLIST 1
cbd-device-search
Searches devices in your organization.
Required Permissions
RBAC Permissions Required - device: READ
Base Command
cbd-device-search
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The identifier for the device. | Optional |
| os | The operating system. Possible values: “WINDOWS”, “MAC”, “LINUX”, and “OTHER”. Possible values are: WINDOWS, MAC, LINUX, OTHER. | Optional |
| status | The status of the device. Possible values: “PENDING”, “REGISTERED”, “DEREGISTERED”, “BYPASS”, “ACTIVE”, “INACTIVE”, “ERROR”, “ALL”, “BYPASS_ON”, “LIVE”, “SENSOR_PENDING_UPDATE”. Possible values are: PENDING, REGISTERED, DEREGISTERED, BYPASS, ACTIVE, INACTIVE, ERROR, ALL, BYPASS_ON, LIVE, SENSOR_PENDING_UPDATE. | Optional |
| start_time | The time to start getting results. specified as ISO-8601 strings for example: “2021-01-27T12:43:26.243Z”. | Optional |
| target_priority | The “Target value” configured in the policy assigned to the sensor. Possible values: “LOW”, “MEDIUM”, “HIGH”, “MISSION_CRITICAL”. Possible values are: LOW, MEDIUM, HIGH, MISSION_CRITICAL. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| end_time | The time to stop getting results. specified as ISO-8601 strings for example: “2021-02-27T12:43:26.243Z”. | Optional |
| rows | The maximum number of rows to return. Default is 20. Default is 20. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Device.activation_code | String | The device activation code to register the sensor with a specific organization. |
| CarbonBlackDefense.Device.activation_code_expiry_time | Date | The time when the activation code expires and cannot be used to register a device. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.ad_group_id | Number | The Active Directory group ID to match. |
| CarbonBlackDefense.Device.appliance_name | String | The name of the appliance the Virtual Machine (VM) is associated with. |
| CarbonBlackDefense.Device.appliance_uuid | String | The UUID of the appliance the VM is associated with. |
| CarbonBlackDefense.Device.av_ave_version | String | The AVE version (part of AV Version). |
| CarbonBlackDefense.Device.av_engine | String | The current antivirus (AV) version. |
| CarbonBlackDefense.Device.av_last_scan_time | Date | The last time a local scan completed. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.av_master | Boolean | Whether the device is an AV Master. |
| CarbonBlackDefense.Device.av_pack_version | String | The pack version (part of AV version). |
| CarbonBlackDefense.Device.av_product_version | String | The product version (part of AV version). |
| CarbonBlackDefense.Device.av_status | String | The status of the local scan. For example [ “AV_ACTIVE”, “AV_REGISTERED” ]. (AV_NOT_REGISTERED, AV_REGISTERED, AV_DEREGISTERED, AV_ACTIVE, AV_BYPASS, SIGNATURE_UPDATE_DISABLED, ONACCESS_SCAN_DISABLED, ONDEMAND_SCAN_DISABLED, PRODUCT_UPDATE_DISABLED). |
| CarbonBlackDefense.Device.av_update_servers | Unknown | A list of the device’s AV servers. For example [ “string”, “string” ]. |
| CarbonBlackDefense.Device.av_vdf_version | String | VDF version (part of AV version). |
| CarbonBlackDefense.Device.cluster_name | String | Name of the cluster. A cluster is a group of hosts. |
| CarbonBlackDefense.Device.current_sensor_policy_name | String | The name of the policy currently configured on the sensor. |
| CarbonBlackDefense.Device.datacenter_name | String | The name of the underlying data center. The data center managed object provides the interface to the common container object for hosts, virtual machines, networks, and datastores. |
| CarbonBlackDefense.Device.deployment_type | String | The device’s deployment type. This is a classification that is determined by its lifecycle management policy. (ENDPOINT, WORKLOAD). |
| CarbonBlackDefense.Device.deregistered_time | Date | The time when the deregister request was received. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.device_meta_data_item_list.key_name | String | The key name that describes the device. |
| CarbonBlackDefense.Device.device_meta_data_item_list.key_value | String | The key value that describes the device. |
| CarbonBlackDefense.Device.device_meta_data_item_list.position | Number | The position that describes the device. |
| CarbonBlackDefense.Device.device_owner_id | Number | The identifier for the device owner associated with the device. |
| CarbonBlackDefense.Device.email | String | The email address for the device owner. |
| CarbonBlackDefense.Device.encoded_activation_code | String | The encoded activation code. |
| CarbonBlackDefense.Device.esx_host_name | String | The name of the ESX host on which the VM is deployed. |
| CarbonBlackDefense.Device.esx_host_uuid | String | The UUID of the ESX host on which the VM is deployed. |
| CarbonBlackDefense.Device.first_name | String | The first name of the device owner. |
| CarbonBlackDefense.Device.id | Number | The ID of the device. |
| CarbonBlackDefense.Device.last_contact_time | Date | The last time the sensor contacted Carbon Black Cloud. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_device_policy_changed_time | Date | The last time the sensor changed from one policy to another. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_device_policy_requested_time | Date | The last time the sensor checked for changes to the policy. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_external_ip_address | String | The last IP address of the device according to Carbon Black Cloud. This can differ from the last_internal_ip_address due to the network proxy or NAT. Can be either IPv4 or IPv6 format. |
| CarbonBlackDefense.Device.last_internal_ip_address | String | The last IP address of the device reported by the sensor. Can be either IPv4 or IPv6 format. |
| CarbonBlackDefense.Device.last_location | String | The device’s current location relative to the organization’s network, based on the current IP address and the device’s registered DNS domain suffix. (UNKNOWN, ONSITE, OFFSITE). |
| CarbonBlackDefense.Device.last_name | String | The last name of the device owner. |
| CarbonBlackDefense.Device.last_policy_updated_time | Date | The last time the current policy received an update. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_reported_time | Date | The last time Carbon Black Cloud received one or more events reported by the sensor. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_reset_time | Date | The last time the device was reset. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_shutdown_time | Date | The last time the device was shutdown. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.linux_kernel_version | String | Not implemented. |
| CarbonBlackDefense.Device.login_user_name | String | The last user who logged in to the device. (Requires Windows Carbon Black Cloud sensor). |
| CarbonBlackDefense.Device.mac_address | String | The media access control (MAC) address for the device’s primary interface. (Requires Windows CBC sensor version 3.6.0.1941 or later, or macOS CBC sensor). |
| CarbonBlackDefense.Device.middle_name | String | The middle name of the device owner. |
| CarbonBlackDefense.Device.name | String | The hostname of the endpoint recorded by the sensor when last initialized. |
| CarbonBlackDefense.Device.organization_id | Number | The organization identifier. |
| CarbonBlackDefense.Device.organization_name | String | The organization name. |
| CarbonBlackDefense.Device.os | String | The operating system. (WINDOWS, MAC, LINUX, OTHER). |
| CarbonBlackDefense.Device.os_version | String | The operating system and version of the endpoint. |
| CarbonBlackDefense.Device.passive_mode | Boolean | Whether the device is in bypass mode. |
| CarbonBlackDefense.Device.policy_id | Number | The policy identifier assigned to the device. |
| CarbonBlackDefense.Device.policy_name | String | The policy name assigned to the device. This name may not match the current_sensor_policy_name until the sensor checks back in. |
| CarbonBlackDefense.Device.policy_override | Boolean | Whether the policy was manually assigned to override mass sensor management. |
| CarbonBlackDefense.Device.quarantined | Boolean | The indicator that the device is in quarantine mode. |
| CarbonBlackDefense.Device.registered_time | Date | The time when the device was registered with Carbon Black Cloud. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_last_action_time | Date | The last time the background scan was started or stopped. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_last_complete_time | Date | The time the last background scan completed. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_status | String | The status of the background scan. (NEVER_RUN, STOPPED, IN_PROGRESS, COMPLETED). |
| CarbonBlackDefense.Device.sensor_kit_type | String | The type of sensor installed on the device. (XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX). |
| CarbonBlackDefense.Device.sensor_out_of_date | Boolean | Whether there is a new version available to be installed. |
| CarbonBlackDefense.Device.sensor_pending_update | Boolean | Whether the sensor is marked by the sensor updater service for a sensor upgrade. |
| CarbonBlackDefense.Device.sensor_states | String | The states the sensor is in. For example [ “ACTIVE”, “LIVE_RESPONSE_ENABLED” ]. (ACTIVE, PANICS_DETECTED, LOOP_DETECTED, DB_CORRUPTION_DETECTED, CSR_ACTION, REPUX_ACTION, DRIVER_INIT_ERROR, REMGR_INIT_ERROR, UNSUPPORTED_OS, SENSOR_UPGRADE_IN_PROGRESS, SENSOR_UNREGISTERED, WATCHDOG, SENSOR_RESET_IN_PROGRESS, DRIVER_INIT_REBOOT_REQUIRED, DRIVER_LOAD_NOT_GRANTED, SENSOR_SHUTDOWN, SENSOR_MAINTENANCE, FULL_DISK_ACCESS_NOT_GRANTED, DEBUG_MODE_ENABLED, AUTO_UPDATE_DISABLED, SELF_PROTECT_DISABLED, VDI_MODE_ENABLED, POC_MODE_ENABLED, SECURITY_CENTER_OPTLN_DISABLED, LIVE_RESPONSE_RUNNING, LIVE_RESPONSE_NOT_RUNNING, LIVE_RESPONSE_KILLED, LIVE_RESPONSE_NOT_KILLED, LIVE_RESPONSE_ENABLED, LIVE_RESPONSE_DISABLED, DRIVER_KERNEL, DRIVER_USERSPACE). |
| CarbonBlackDefense.Device.sensor_version | String | The version of the installed sensor in the format: #.#.#.#. |
| CarbonBlackDefense.Device.status | String | The status of the device. (PENDING, REGISTERED, DEREGISTERED, BYPASS Additional searchable statuses that are not returnable ACTIVE, INACTIVE, ERROR, ALL, BYPASS_ON, LIVE, SENSOR_PENDING_UPDATE). |
| CarbonBlackDefense.Device.target_priority | String | Device target priorities to match. (LOW, MEDIUM, HIGH, MISSION_CRITICAL). |
| CarbonBlackDefense.Device.uninstall_code | String | The code to enter when uninstalling the sensor. |
| CarbonBlackDefense.Device.vcenter_host_url | String | The vCenter host URL. |
| CarbonBlackDefense.Device.vcenter_name | String | The name of the vCenter the VM is associated with. |
| CarbonBlackDefense.Device.vcenter_uuid | String | The 128-bit SMBIOS UUID of a vCenter represented as a hexadecimal string. |
| CarbonBlackDefense.Device.vdi_base_device | Number | The identifier of the device from which this device was cloned/re-registered. |
| CarbonBlackDefense.Device.virtual_machine | Boolean | Whether this device is a virtual machine (VMware AppDefense integration). Deprecated for deployment_type. |
| CarbonBlackDefense.Device.virtualization_provider | String | The name of the VM virtualization provider. |
| CarbonBlackDefense.Device.vm_ip | String | The IP address of the VM. |
| CarbonBlackDefense.Device.vm_name | String | The name of the VM that the sensor is deployed on. |
| CarbonBlackDefense.Device.vm_uuid | String | The 128-bit SMBIOS UUID of a virtual machine represented as a hexadecimal string. (Format: 12345678-abcd-1234-cdef-123456789abc). |
| CarbonBlackDefense.Device.vulnerability_score | Number | The vulnerability score from 0 to 100 indicating the workload’s level of vulnerability with 100 being highly vulnerable. |
| CarbonBlackDefense.Device.vulnerability_severity | String | The severity level indicating the workload’s vulnerability. (CRITICAL, MODERATE, IMPORTANT, LOW). |
| CarbonBlackDefense.Device.windows_platform | String | Deprecated for os_version. (CLIENT_X86, CLIENT_X64, SERVER_X86, SERVER_X64, CLIENT_ARM64, SERVER_ARM64). |
Command Example
#### Context Example
```json
{
"CarbonBlackDefense": {
"Device": [
{
"activation_code": null,
"activation_code_expiry_time": "2020-10-27T13:49:46.641Z",
"ad_group_id": 0,
"appliance_name": null,
"appliance_uuid": null,
"av_ave_version": null,
"av_engine": "",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": null,
"av_product_version": null,
"av_status": null,
"av_update_servers": null,
"av_vdf_version": null,
"cluster_name": null,
"current_sensor_policy_name": "test",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "CentOS 7",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "11.1.1",
"position": 0
}
],
"device_owner_id": 556712,
"email": "squee",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"id": 1234,
"last_contact_time": "2021-04-04T13:29:14.616Z",
"last_device_policy_changed_time": "2021-03-22T18:02:05.742Z",
"last_device_policy_requested_time": "2021-03-22T18:02:57.571Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "8.8.8.8",
"last_location": "UNKNOWN",
"last_name": null,
"last_policy_updated_time": "2021-03-08T21:03:41.776Z",
"last_reported_time": "2021-04-04T13:29:14.440Z",
"last_reset_time": null,
"last_shutdown_time": null,
"linux_kernel_version": null,
"login_user_name": null,
"mac_address": null,
"middle_name": null,
"name": "bo1tapsandbox-01",
"organization_id": 1105,
"organization_name": "cb-internal-alliances.com",
"os": "LINUX",
"os_version": "CentOS 7.9-2009",
"passive_mode": false,
"policy_id": 63139,
"policy_name": "LRDemo-JH",
"policy_override": true,
"quarantined": false,
"registered_time": "2020-10-20T13:49:46.675Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_kit_type": "RHEL",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_ENABLED",
"LIVE_RESPONSE_NOT_KILLED",
"ACTIVE"
],
"sensor_version": "2.9.0.312585",
"status": "REGISTERED",
"target_priority": "MEDIUM",
"uninstall_code": "TS3HIY27",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"virtual_machine": true,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 0,
"vulnerability_severity": null,
"windows_platform": null
},
{
"activation_code": "VQ6IT3",
"activation_code_expiry_time": "2020-12-25T00:24:45.326Z",
"ad_group_id": 0,
"appliance_name": null,
"appliance_uuid": null,
"av_ave_version": "1.2.3.4",
"av_engine": "4.14.3.454-ave.1.1.1.1:avpack.2.2.2.2:vdf.3.3.3.3:apc.4.4.4.4",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": "1.2.3.4",
"av_product_version": "4.14.3.454",
"av_status": [
"AV_ACTIVE",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": "1.2.3.4",
"cluster_name": null,
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows 10",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "10.33.4",
"position": 0
},
{
"key_name": "AD_LDAP",
"key_value": "OU=Domain Controllers,DC=redteam,DC=aelladata,DC=com",
"position": 0
}
],
"device_owner_id": 605596,
"email": "jon@example.ai",
"encoded_activation_code": "L8ANCTWT9P7",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": "Yubao",
"id": 5678,
"last_contact_time": "2021-04-04T13:29:14.056Z",
"last_device_policy_changed_time": "2021-03-16T11:44:32.072Z",
"last_device_policy_requested_time": "2021-04-04T13:27:44.316Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "8.8.8.8",
"last_location": "OFFSITE",
"last_name": "Zhang",
"last_policy_updated_time": "2021-04-02T06:05:12.968Z",
"last_reported_time": "2021-04-04T13:19:54.003Z",
"last_reset_time": null,
"last_shutdown_time": null,
"linux_kernel_version": null,
"login_user_name": "",
"mac_address": "000c290c520c",
"middle_name": null,
"name": "REDTEAM\\malware-gen2",
"organization_id": 1105,
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows Server 2016 x64",
"passive_mode": true,
"policy_id": 6525,
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2020-12-18T03:58:59.811Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"DRIVER_INIT_ERROR",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED",
"SECURITY_CENTER_OPTLN_DISABLED"
],
"sensor_version": "3.6.0.1941",
"status": "BYPASS",
"target_priority": "LOW",
"uninstall_code": "PDLHMMYF",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"virtual_machine": true,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 0,
"vulnerability_severity": null,
"windows_platform": null
},
{
"activation_code": "EYIAHV",
"activation_code_expiry_time": "2021-02-25T20:58:03.232Z",
"ad_group_id": 0,
"appliance_name": null,
"appliance_uuid": null,
"av_ave_version": "5.5.5.5",
"av_engine": "1.1.1.1-ave.2.2.2.2:avpack.3.3.3.3:vdf.4.4.4.4",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": "5.5.5.5",
"av_product_version": "4.14.3.454",
"av_status": [
"AV_ACTIVE",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": "5.5.5.5",
"cluster_name": null,
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows 10",
"position": 0
},
{
"key_name": "AD_LDAP",
"key_value": "DC=rtest,DC=com",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "172.16.15",
"position": 0
}
],
"device_owner_id": 605966,
"email": "jon@example.com",
"encoded_activation_code": "2VNKDLWE3UT",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": "Brandon",
"id": 9101,
"last_contact_time": "2021-04-04T13:29:13.643Z",
"last_device_policy_changed_time": "2021-03-31T20:11:50.835Z",
"last_device_policy_requested_time": "2021-04-02T06:05:52.963Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "8.8.8.8",
"last_location": "OFFSITE",
"last_name": "Van Pelt",
"last_policy_updated_time": "2021-04-02T06:05:12.968Z",
"last_reported_time": "2021-04-04T05:28:57.161Z",
"last_reset_time": null,
"last_shutdown_time": null,
"linux_kernel_version": null,
"login_user_name": "RTEST\\opryadko",
"mac_address": "0050569fdd57",
"middle_name": null,
"name": "AB\\ABC-123-Win10E",
"organization_id": 1105,
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows 10 x64",
"passive_mode": false,
"policy_id": 6525,
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2021-02-18T18:22:10.545Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"ACTIVE",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED",
"SECURITY_CENTER_OPTLN_DISABLED"
],
"sensor_version": "3.6.0.1979",
"status": "REGISTERED",
"target_priority": "LOW",
"uninstall_code": "KMVSAQLT",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"virtual_machine": true,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 0,
"vulnerability_severity": null,
"windows_platform": null
}
]
}
}
Human Readable Output
Carbon Black Endpoint Standard Devices List Results
Id Name Os Policy Name Quarantined Status Target Priority Last Internal Ip Address Last External Ip Address Last Contact Time Last Location 1234 bo1tapsandbox-01 LINUX LRDemo-JH false REGISTERED MEDIUM 8.8.8.8 1.1.1.1 2021-04-04T13:29:14.616Z UNKNOWN 5678 REDTEAM\malware-gen2 WINDOWS default false BYPASS LOW 8.8.8.8 1.1.1.1 2021-04-04T13:29:14.056Z OFFSITE 9101 RTEST\Oleg-TB2-Win10E WINDOWS default false REGISTERED LOW 8.8.8.8 1.1.1.1 2021-04-04T13:29:13.643Z OFFSITE
cbd-find-processes
Creates a process search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, and time_range) is required.
Required Permissions
RBAC Permissions Required - org.search.events: CREATE
Base Command
cbd-find-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_category | The Carbon Black Cloud classification for events tagged to an alert. Possible values: “THREAT” and “OBSERVED”. Possible values are: THREAT, OBSERVED. | Optional |
| hash | Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). | Optional |
| device_external_ip | The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. | Optional |
| device_id | The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. | Optional |
| device_internal_ip | The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. | Optional |
| device_name | The hostname of the endpoint recorded by the sensor when last initialized. | Optional |
| device_os | The operating system of the endpoint. Possible values: “WINDOWS”, “MAC”, “LINUX”. Possible values are: WINDOWS, MAC, LINUX. | Optional |
| device_timestamp | The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z. | Optional |
| event_type | The type of enriched event observed. Possible value: “filemod”, “netconn”, “regmod”, “modload”, “crossproc”, “childproc”, “scriptload”, and “fileless_scriptload”. Possible values are: filemod, netconn, regmod, modload, crossproc, childproc, scriptload, fileless_scriptload. | Optional |
| parent_name | The file system path of the parent process binary. | Optional |
| parent_reputation | The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. Possible values are: ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Optional |
| process_cmdline | The command line executed by the actor process. | Optional |
| process_guid | The unique process identifier for the actor process. | Optional |
| process_name | The file system path of the actor process binary. | Optional |
| process_pid | The process identifier assigned by the operating system. This can be multi-valued in case of fork() or exec() process operations on Linux and macOS. | Optional |
| process_reputation | The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. Possible values are: ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Optional |
| process_start_time | The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts. | Optional |
| process_terminated | Whether the process has terminated. Possible values: “true” and “false”. Always “false” for enriched events (process termination not recorded). Possible values are: true, false. | Optional |
| process_username | The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). |
Optional |
| sensor_action | The action performed by the sensor on the process. Possible values: “TERMINATE”, “DENY”, and “SUSPEND”. Possible values are: TERMINATE, DENY, SUSPEND. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of rows to request. Can be paginated. | Optional |
| start | The first row to use for pagination. | Optional |
| time_range | The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {“end”: “2020-01-21T18:34:04Z”, “start”: “2020-01-18T18:34:04Z”, “window”: “-2w”}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Process.Search.job_id | String | The job ID of the process search. |
Command Example
!cbd-find-processes query=chrome
Context Example
{
"CarbonBlackDefense": {
"Process": {
"Search": {
"job_id": "f5a2ae0e-c3f7-4443-882d-009097eaabd3"
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Processes Search
Job Id f5a2ae0e-c3f7-4443-882d-009097eaabd3
cbd-find-events
Creates an enriched events search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, time_range) is required).
Required Permissions
RBAC Permissions Required - org.search.events: CREATE
Base Command
cbd-find-events
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_category | The Carbon Black Cloud classification for events tagged to an alert. Possible values: “THREAT” and “OBSERVED”. Possible values are: THREAT, OBSERVED. | Optional |
| hash | Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). | Optional |
| device_external_ip | The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. | Optional |
| device_id | The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. | Optional |
| device_internal_ip | The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. | Optional |
| device_name | The hostname of the endpoint recorded by the sensor when last initialized. | Optional |
| device_os | The operating system of the endpoint. Possible values: “WINDOWS”, “MAC”, “LINUX”. Possible values are: WINDOWS, MAC, LINUX. | Optional |
| event_type | The type of enriched event observed. Possible value: “filemod”, “netconn”, “regmod”, “modload”, “crossproc”, “childproc”, “scriptload”, and “fileless_scriptload”. Possible values are: filemod, netconn, regmod, modload, crossproc, childproc, scriptload, fileless_scriptload. | Optional |
| parent_name | The file system path of the parent process binary. | Optional |
| parent_reputation | The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. Possible values are: ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Optional |
| process_cmdline | The command line executed by the actor process. | Optional |
| process_guid | The unique process identifier for the actor process. | Optional |
| process_name | The file system path of the actor process binary. | Optional |
| process_pid | The process identifier assigned by the operating system. This can be multi-valued in case of fork() or exec() process operations on Linux and macOS. | Optional |
| process_reputation | The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. Possible values are: ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Optional |
| process_start_time | The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts. | Optional |
| process_terminated | Whether the process has terminated. Possible values: “true” and “false”. Always “false” for enriched events (process termination not recorded). Possible values are: true, false. | Optional |
| process_username | The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). |
Optional |
| sensor_action | The action performed by the sensor on the process. Possible values: “TERMINATE”, “DENY”, and “SUSPEND”. Possible values are: TERMINATE, DENY, SUSPEND. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of rows to request. Can be paginated. | Optional |
| start | The first row to use for pagination. | Optional |
| time_range | The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {“end”: “2020-01-21T18:34:04Z”, “start”: “2020-01-18T18:34:04Z”, “window”: “-2w”}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Events.Search.job_id | String | The job ID of the event search. |
Command Example
!cbd-find-events query=chrome
Context Example
{
"CarbonBlackDefense": {
"Events": {
"Search": {
"job_id": "b853bf18-d1f3-4dcc-b590-6626ee547bec"
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Events Search
Job Id b853bf18-d1f3-4dcc-b590-6626ee547bec
cbd-find-processes-results
Retrieves the results of a process search identified by the job ID.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cbd-find-processes-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. | Required |
| rows | The number of rows to request. Can be paginated. Default is 10. Default is 10. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Process.Results.job_id | String | The results of the process search. |
| CarbonBlackDefense.Process.Results.approximate_unaggregated | Number | The approximate number of unaggregated results. |
| CarbonBlackDefense.Process.Results.completed | Number | The number of completed results. |
| CarbonBlackDefense.Process.Results.contacted | Number | The number of contacted results. |
| CarbonBlackDefense.Process.Results.num_aggregated | Number | The number of aggregated results. |
| CarbonBlackDefense.Process.Results.num_available | Number | The number of processes available in this search. |
| CarbonBlackDefense.Process.Results.num_found | Number | The number of processes found in this search. |
| CarbonBlackDefense.Process.Results.results | Unknown | The lists that contains the data of the results for this search. |
Command Example
!cbd-find-processes-results job_id=a79f5a25-5ab4-4df7-b806-62e0aedd7034
Context Example
{
"CarbonBlackDefense": {
"Process": {
"Results": {
"job_id": "a79f5a25-5ab4-4df7-b806-62e0aedd7034",
"approximate_unaggregated": 35890,
"completed": 47,
"contacted": 47,
"num_aggregated": 3230,
"num_available": 500,
"num_found": 35890,
"results": [
{
"backend_timestamp": "2021-04-04T11:14:46.886Z",
"device_group_id": 0,
"device_id": 1234,
"device_name": "vm-2k12-vg63",
"device_policy_id": 1234,
"device_timestamp": "2021-04-04T11:13:52.850Z",
"enriched": true,
"enriched_event_type": [
"NETWORK"
],
"event_type": [
"netconn"
],
"ingress_time": 1617534862426,
"legacy": true,
"org_id": "7DESJ9GN",
"process_guid": "7DESJ9GN-003ecd38-002005cc-00000000-1d719ba5c26912d",
"process_hash": [
"402a3d06bc6c0051e65c91e1bddac9d7",
"cbc104fcc03cb2acbdafc2fe2669e8da54993f8d21d8851d4d80ecec26a3a9f0"
],
"process_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"process_pid": [
2098636
],
"process_username": [
"VM-2K12-VG63\\Administrator"
]
},
{
"backend_timestamp": "2021-04-04T11:15:17.238Z",
"childproc_count": 0,
"crossproc_count": 389,
"device_group_id": 0,
"device_id": 5678,
"device_name": "development\\vm-beats-dev",
"device_policy_id": 1234,
"device_timestamp": "2021-04-04T11:13:38.546Z",
"enriched": true,
"enriched_event_type": [
"NETWORK"
],
"event_type": [
"netconn"
],
"filemod_count": 21432,
"ingress_time": 1617534886234,
"legacy": true,
"modload_count": 252,
"netconn_count": 3388,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003b7b6c-00001e8c-00000000-1d716fd3d5cd170",
"parent_pid": 7820,
"process_guid": "7DESJ9GN-003b7b6c-00000bb4-00000000-1d716fd3ea4f2fa",
"process_hash": [
"6bfe4850808952622e41f88db244393b",
"8ceee04d6316e2ba04fdf2222506fc8be7b3cd158d843c4edc23d8de5e2f77d9"
],
"process_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"process_pid": [
2996
],
"process_username": [
"AB\\example.process"
],
"regmod_count": 0,
"scriptload_count": 0
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"null/115E98DB"
],
"backend_timestamp": "2021-04-04T11:15:17.238Z",
"childproc_count": 862,
"crossproc_count": 530,
"device_group_id": 0,
"device_id": 9101,
"device_name": "development\\vm-beats-dev",
"device_policy_id": 1234,
"device_timestamp": "2021-04-04T11:12:41.447Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_type": [
"childproc"
],
"filemod_count": 43922,
"ingress_time": 1617534886234,
"legacy": true,
"modload_count": 1239,
"netconn_count": 807,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003b7b6c-000006a0-00000000-1d7166c204a7a5a",
"parent_pid": 1696,
"process_guid": "7DESJ9GN-003b7b6c-00001e8c-00000000-1d716fd3d5cd170",
"process_hash": [
"6bfe4850808952622e41f88db244393b",
"8ceee04d6316e2ba04fdf2222506fc8be7b3cd158d843c4edc23d8de5e2f77d9"
],
"process_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"process_pid": [
7820
],
"process_username": [
"AB\\example.process"
],
"regmod_count": 117,
"scriptload_count": 0
}
]
}
}
}
}
Human Readable Output
The Results For The Process Search
Device Id Device Name Process Name Device Policy Id Enriched Event Type 1234 vm-2k12-vg63 c:\program files (x86)\google\chrome\application\chrome.exe 1234 NETWORK 5678 development\vm-beats-dev c:\program files (x86)\google\chrome\application\chrome.exe 1234 NETWORK 9101 development\vm-beats-dev c:\program files (x86)\google\chrome\application\chrome.exe 1234 CREATE_PROCESS
cbd-get-policies
Gets the list of policies available in your organization.
Required Permissions
Live Response Permissions Required
Base Command
cbd-get-policies
Input
There are no input arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.id | Number | The policy ID. |
| CarbonBlackDefense.Policy.priorityLevel | String | The policy priority level. |
| CarbonBlackDefense.Policy.systemPolicy | Boolean | Whether the policy is a system policy. |
| CarbonBlackDefense.Policy.latestRevision | Number | The latest revision of the policy. |
| CarbonBlackDefense.Policy.policy | Unknown | The policy object. |
| CarbonBlackDefense.Policy.name | String | The unique name of the policy. |
| CarbonBlackDefense.Policy.description | String | The description of the policy. |
| CarbonBlackDefense.Policy.version | Number | The version of the policy. |
Command Example
#### Context Example
```json
{
"CarbonBlackDefense": {
"Policy": [
{
"description": "Default Policy. Please do not edit or rename this Policy. Create your own Policy and test with that.",
"id": 6525,
"latestRevision": 1617343512968,
"name": "default",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "KNOWN_MALWARE"
},
"id": 111,
"operation": "RUN",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 112,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 113,
"operation": "NETWORK",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 114,
"operation": "MEMORY_SCRAPE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 115,
"operation": "RUN_INMEMORY_CODE",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 117,
"operation": "POL_INVOKE_NOT_TRUSTED",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 118,
"operation": "INVOKE_CMD_INTERPRETER",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 119,
"operation": "RANSOM",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 120,
"operation": "INVOKE_SCRIPT",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 121,
"operation": "CODE_INJECTION",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "PUP"
},
"id": 122,
"operation": "RUN",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "SUSPECT_MALWARE"
},
"id": 123,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 124,
"operation": "NETWORK",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 125,
"operation": "MEMORY_SCRAPE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 126,
"operation": "RUN_INMEMORY_CODE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 128,
"operation": "POL_INVOKE_NOT_TRUSTED",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 129,
"operation": "INVOKE_CMD_INTERPRETER",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 130,
"operation": "RANSOM",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 131,
"operation": "INVOKE_SCRIPT",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 132,
"operation": "CODE_INJECTION",
"required": false
}
],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "false"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "false"
},
{
"name": "DELAY_EXECUTE",
"value": "false"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "true"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "LOW",
"systemPolicy": true,
"version": 2
},
{
"description": null,
"id": 6527,
"latestRevision": 1613421692562,
"name": "Detection_Servers",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 8,
"recoveryScanIfMissed": true,
"startHour": 20
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 2,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 0,
"regId": null,
"server": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
],
"serversForOffSiteDevices": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 2,
"operation": "RANSOM",
"required": true
}
],
"sensorSettings": [
{
"name": "ALLOW_UPLOADS",
"value": "true"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Device has been quarantined by your computer administrator."
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "false"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
}
]
},
"priorityLevel": "HIGH",
"systemPolicy": true,
"version": 2
},
{
"description": null,
"id": 6528,
"latestRevision": 1613421692592,
"name": "Restrictive_Mac_Workstation",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 8,
"recoveryScanIfMissed": true,
"startHour": 20
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 2,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 0,
"regId": null,
"server": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
],
"serversForOffSiteDevices": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "KNOWN_MALWARE"
},
"id": 9,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 10,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "SUSPECT_MALWARE"
},
"id": 11,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "PUP"
},
"id": 12,
"operation": "RUN",
"required": false
}
],
"sensorSettings": [
{
"name": "ALLOW_UPLOADS",
"value": "true"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Device has been quarantined by your computer administrator."
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "false"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
}
]
},
"priorityLevel": "MEDIUM",
"systemPolicy": true,
"version": 2
}
]
}
}
Human Readable Output
Carbon Black Endpoint Standard Policies
Id Priority Level System Policy Latest Revision Version 6525 LOW true 2021-04-02T06:05:12.000Z 2 6527 HIGH true 2021-02-15T20:41:32.000Z 2 6528 MEDIUM true 2021-02-15T20:41:32.000Z 2
cbd-get-policy
Retrieves a policy object by ID.
Required Permissions
Live Response Permissions Required
Base Command
cbd-get-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.id | Number | The policy ID. |
| CarbonBlackDefense.Policy.priorityLevel | String | The policy priority level. |
| CarbonBlackDefense.Policy.systemPolicy | Boolean | Whether the policy is a system policy. |
| CarbonBlackDefense.Policy.latestRevision | Number | The latest revision of the policy. |
| CarbonBlackDefense.Policy.policy | Unknown | The policy object. |
| CarbonBlackDefense.Policy.name | String | The unique name of the policy. |
| CarbonBlackDefense.Policy.description | String | The description of the policy. |
| CarbonBlackDefense.Policy.version | Number | The version of the policy. |
Command Example
!cbd-get-policy policyId=6527
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": null,
"id": 6527,
"latestRevision": 1613421692562,
"name": "Detection_Servers",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 8,
"recoveryScanIfMissed": true,
"startHour": 20
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 2,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 0,
"regId": null,
"server": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
],
"serversForOffSiteDevices": [
"http://updates2.cdc.carbonblack.io/update2"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 2,
"operation": "RANSOM",
"required": true
}
],
"sensorSettings": [
{
"name": "ALLOW_UPLOADS",
"value": "true"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Device has been quarantined by your computer administrator."
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "false"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
}
]
},
"priorityLevel": "HIGH",
"systemPolicy": true,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Name Latest Revision Version Priority Level System Policy 6527 Detection_Servers 2021-02-15T20:41:32.000Z 2 HIGH true
cbd-set-policy
Resets policy fields.
Required Permissions
Live Response Permissions Required
Base Command
cbd-set-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policy | The policy ID to be set. | Required |
| keyValue | A JSON object that holds key/value pairs. The key is the field path in the policy object you want to update with a value. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.id | Number | The policy ID. |
| CarbonBlackDefense.Policy.priorityLevel | String | The policy priority level. |
| CarbonBlackDefense.Policy.systemPolicy | Boolean | Whether the policy is a system policy. |
| CarbonBlackDefense.Policy.latestRevision | Number | The latest revision of the policy. |
| CarbonBlackDefense.Policy.policy | Unknown | The policy object. |
| CarbonBlackDefense.Policy.name | String | The unique name of the policy. |
| CarbonBlackDefense.Policy.description | String | The description of the policy. |
| CarbonBlackDefense.Policy.version | Number | The version of the policy. |
Command Example
!cbd-set-policy policy=123456 keyValue=`{"policyInfo": {"description": "update example", "name": "xsoar test1", "id": 123456, "policy": {"sensorSettings": [{"name": "SHOW_UI", "value": "true"}]}, "priorityLevel": "HIGH"}}`
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "update example",
"id": 123456,
"latestRevision": 1617542937951,
"name": "xsoar test1",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "true"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "true"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "HIGH",
"systemPolicy": false,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Description Name Latest Revision Version Priority Level System Policy 123456 update example xsoar test1 2021-04-04T13:28:57.000Z 2 HIGH false
cbd-create-policy
Creates a new policy on the CB Defense backend.
Required Permissions
Live Response Permissions Required
Base Command
cbd-create-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A description of the policy. Can be multiple lines. | Required |
| name | A unique one-line name for the policy. | Required |
| priorityLevel | The priority score associated with sensors assigned to this policy. Possible values: “MISSION_CRITICAL”, “HIGH”, “MEDIUM”, and “LOW”. Possible values are: MISSION_CRITICAL, HIGH, MEDIUM, LOW. | Required |
| policy | The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy’s fields with the set-policy command, and pass the edited object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.id | Number | The policy ID. |
| CarbonBlackDefense.Policy.priorityLevel | String | The policy priority level. |
| CarbonBlackDefense.Policy.systemPolicy | Boolean | Whether the policy is a system policy. |
| CarbonBlackDefense.Policy.latestRevision | Number | The latest revision of the policy. |
| CarbonBlackDefense.Policy.policy | Unknown | The policy object. |
| CarbonBlackDefense.Policy.name | String | The unique name of the policy. |
| CarbonBlackDefense.Policy.description | String | The description of the policy. |
| CarbonBlackDefense.Policy.version | Number | The version of the policy. |
Command Example
!cbd-create-policy description=`This is xsoar's test policy` name=`xsoar test3` priorityLevel=HIGH policy=`{}`
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "This is xsoar's test policy",
"id": 67586,
"latestRevision": 1617542929543,
"name": "xsoar test3",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "KNOWN_MALWARE"
},
"id": 111,
"operation": "RUN",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 112,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 113,
"operation": "NETWORK",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 114,
"operation": "MEMORY_SCRAPE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 115,
"operation": "RUN_INMEMORY_CODE",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 117,
"operation": "POL_INVOKE_NOT_TRUSTED",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 118,
"operation": "INVOKE_CMD_INTERPRETER",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 119,
"operation": "RANSOM",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 120,
"operation": "INVOKE_SCRIPT",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "RESOLVING"
},
"id": 121,
"operation": "CODE_INJECTION",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "PUP"
},
"id": 122,
"operation": "RUN",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "SUSPECT_MALWARE"
},
"id": 123,
"operation": "RUN",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 124,
"operation": "NETWORK",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 125,
"operation": "MEMORY_SCRAPE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 126,
"operation": "RUN_INMEMORY_CODE",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 128,
"operation": "POL_INVOKE_NOT_TRUSTED",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 129,
"operation": "INVOKE_CMD_INTERPRETER",
"required": false
},
{
"action": "TERMINATE",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 130,
"operation": "RANSOM",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 131,
"operation": "INVOKE_SCRIPT",
"required": false
},
{
"action": "DENY",
"application": {
"type": "REPUTATION",
"value": "ADAPTIVE_WHITE_LIST"
},
"id": 132,
"operation": "CODE_INJECTION",
"required": false
}
],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "false"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "false"
},
{
"name": "DELAY_EXECUTE",
"value": "false"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "true"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "HIGH",
"systemPolicy": false,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Description Name Latest Revision Version Priority Level System Policy 67586 This is xsoar’s test policy xsoar test3 2021-04-04T13:28:49.000Z 2 HIGH false
cbd-delete-policy
Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.
Required Permissions
Live Response Permissions Required
Base Command
cbd-delete-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-delete-policy policyId=67585
Human Readable Output
The policy 67585 was deleted successfully
Message Success Success true
cbd-update-policy
Updates an existing policy with a new policy. Note: System policies cannot be modified.
Required Permissions
Live Response Permissions Required
Base Command
cbd-update-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A description of the policy. | Required |
| name | A one-line name for the policy. | Required |
| priorityLevel | The priority score associated with sensors assigned to this policy. Possible values: “MISSION_CRITICAL”, “HIGH”, “MEDIUM”, and “LOW”. Possible values are: MISSION_CRITICAL, HIGH, MEDIUM, LOW. | Required |
| id | The ID of the policy to replace. | Required |
| policy | The JSON object containing the policy details. Make sure a valid policy object is passed. For example {‘sensorSettings’: [{‘name’: ‘SHOW_UI’, ‘value’: ‘false’}]}. You can use the get-policy command to retrieve the policy object you want to update. Then you can reset some of the policy’s fields with the set-policy command, and pass the edited object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.id | Number | The policy ID. |
| CarbonBlackDefense.Policy.priorityLevel | String | The policy priority level. |
| CarbonBlackDefense.Policy.systemPolicy | Boolean | Whether the policy is a system policy. |
| CarbonBlackDefense.Policy.latestRevision | Number | The latest revision of the policy. |
| CarbonBlackDefense.Policy.policy | Unknown | The policy object. |
| CarbonBlackDefense.Policy.name | String | The unique name of the policy. |
| CarbonBlackDefense.Policy.description | String | The description of the policy. |
| CarbonBlackDefense.Policy.version | Number | The version of the policy. |
Command Example
!cbd-update-policy id=123456 description=`This is xsoar's test policy after an update` name=`xsoar test1` priorityLevel=LOW policy=`{"sensorSettings": [{"name": "SHOW_UI", "value": "false"}]}`
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "This is xsoar's test policy after an update",
"id": 123456,
"latestRevision": 1617542940381,
"name": "xsoar test1",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "true"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "LOW",
"systemPolicy": false,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Description Name Latest Revision Version Priority Level System Policy 123456 This is xsoar’s test policy after an update xsoar test1 2021-04-04T13:29:00.000Z 2 LOW false
cbd-add-rule-to-policy
Adds a new rule to an existing policy. Note: System policies cannot be modified.
Required Permissions
Live Response Permissions Required
Base Command
cbd-add-rule-to-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| action | Rule action. Possible values: “TERMINATE”, “IGNORE”, “TERMINATE_THREAD”, “ALLOW”, “DENY”, and “TERMINATE_PROCESS”. Possible values are: TERMINATE, IGNORE, TERMINATE_THREAD, ALLOW, DENY, TERMINATE_PROCESS. | Required |
| operation | Rule operation. Possible values are: MODIFY_SYSTEM_EXE, PASSTHRU, CRED, RANSOM, NETWORK_SERVER, POL_INVOKE_NOT_TRUSTED, IMPERSONATE, MICROPHONE_CAMERA, INVOKE_SYSAPP, NETWORK_CLIENT, BYPASS_REG, BUFFER_OVERFLOW, BYPASS_API, USER_DOC, CODE_INJECTION, BYPASS_NET, KEYBOARD, BYPASS_ALL, RUN, INVOKE_CMD_INTERPRETER, MODIFY_SYTEM_CONFIG, ESCALATE, BYPASS_FILE, RUN_AS_ADMIN, BYPASS_PROCESS, NETWORK, KERNEL_ACCESS, NETWORK_PEER, PACKED, INVOKE_SCRIPT, MEMORY_SCRAPE, BYPASS_SELF_PROTECT, TAMPER_API. | Required |
| required | Whether the rule is required. Possible values: “true” and “false”. Possible values are: true, false. | Required |
| type | Application type. Possible values: “REPUTATION”, “SIGNED_BY”, and “NAME_PATH”. Possible values are: REPUTATION, SIGNED_BY, NAME_PATH. | Required |
| value | Application value. | Required |
| policyId | The policy ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-add-rule-to-policy action=ALLOW operation=RANSOM required=true type=REPUTATION value=COMPANY_BLACK_LIST policyId=123456
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "This is xsoar's test policy after an update",
"id": 123456,
"latestRevision": 1617542944659,
"name": "xsoar test1",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "ALLOW",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 23,
"operation": "RANSOM",
"required": true
}
],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "true"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "LOW",
"systemPolicy": false,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Description Name Latest Revision Version Priority Level System Policy 123456 This is xsoar’s test policy after an update xsoar test1 2021-04-04T13:29:04.000Z 2 LOW false
cbd-update-rule-in-policy
Updates an existing rule with a new rule. Note: System policies cannot be modified.
Required Permissions
Live Response Permissions Required
Base Command
cbd-update-rule-in-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| action | Rule action. Possible values: “TERMINATE”, “IGNORE”, “TERMINATE_THREAD”, “ALLOW”, “DENY”, and “TERMINATE_PROCESS”. Possible values are: TERMINATE, IGNORE, TERMINATE_THREAD, ALLOW, DENY, TERMINATE_PROCESS. | Required |
| operation | Rule operation. Possible values are: MODIFY_SYSTEM_EXE, PASSTHRU, CRED, RANSOM, NETWORK_SERVER, POL_INVOKE_NOT_TRUSTED, IMPERSONATE, MICROPHONE_CAMERA, INVOKE_SYSAPP, NETWORK_CLIENT, BYPASS_REG, BUFFER_OVERFLOW, BYPASS_API, USER_DOC, CODE_INJECTION, BYPASS_NET, KEYBOARD, BYPASS_ALL, RUN, INVOKE_CMD_INTERPRETER, MODIFY_SYTEM_CONFIG, ESCALATE, BYPASS_FILE, RUN_AS_ADMIN, BYPASS_PROCESS, NETWORK, KERNEL_ACCESS, NETWORK_PEER, PACKED, INVOKE_SCRIPT, MEMORY_SCRAPE, BYPASS_SELF_PROTECT, TAMPER_API. | Required |
| required | Whether the rule is required. Possible values: “true” and “false”. Possible values are: true, false. | Required |
| id | Rule ID. | Required |
| type | Application type. Possible values: “REPUTATION”, “SIGNED_BY”, and “NAME_PATH”. Possible values are: REPUTATION, SIGNED_BY, NAME_PATH. | Required |
| value | Application value. | Required |
| policyId | The policy ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-update-rule-in-policy action=ALLOW operation=RANSOM required=false id=23 type=REPUTATION value=COMPANY_BLACK_LIST policyId=123456
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "This is xsoar's test policy after an update",
"id": 123456,
"latestRevision": 1617542947344,
"name": "xsoar test1",
"policy": {
"avSettings": {
"apc": {
"enabled": false,
"maxExeDelay": 45,
"maxFileSize": 4,
"riskLevel": 4
},
"features": [
{
"enabled": true,
"name": "SIGNATURE_UPDATE"
},
{
"enabled": true,
"name": "ONACCESS_SCAN"
},
{
"enabled": true,
"name": "ONDEMAND_SCAN"
}
],
"onAccessScan": {
"profile": "NORMAL"
},
"onDemandScan": {
"profile": "NORMAL",
"scanCdDvd": "AUTOSCAN",
"scanUsb": "AUTOSCAN",
"schedule": {
"days": null,
"rangeHours": 0,
"recoveryScanIfMissed": true,
"startHour": 0
}
},
"signatureUpdate": {
"schedule": {
"fullIntervalHours": 0,
"initialRandomDelayHours": 1,
"intervalHours": 2
}
},
"updateServers": {
"servers": [
{
"flags": 1,
"regId": null,
"server": [
"http://updates.cdc.carbonblack.io/update"
]
}
],
"serversForOffSiteDevices": [
"http://updates.cdc.carbonblack.io/update"
]
}
},
"directoryActionRules": [],
"id": -1,
"knownBadHashAutoDeleteDelayMs": null,
"rules": [
{
"action": "ALLOW",
"application": {
"type": "REPUTATION",
"value": "COMPANY_BLACK_LIST"
},
"id": 23,
"operation": "RANSOM",
"required": false
}
],
"sensorSettings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "false"
},
{
"name": "ENABLE_THREAT_SHARING",
"value": "true"
},
{
"name": "QUARANTINE_DEVICE",
"value": "false"
},
{
"name": "LOGGING_LEVEL",
"value": "false"
},
{
"name": "QUARANTINE_DEVICE_MESSAGE",
"value": "Your device has been quarantined by your computer administrator."
},
{
"name": "SET_SENSOR_MODE",
"value": "0"
},
{
"name": "SENSOR_RESET",
"value": "0"
},
{
"name": "BACKGROUND_SCAN",
"value": "false"
},
{
"name": "POLICY_ACTION_OVERRIDE",
"value": "true"
},
{
"name": "HELP_MESSAGE",
"value": "CarbonBlack"
},
{
"name": "PRESERVE_SYSTEM_MEMORY_SCAN",
"value": "false"
},
{
"name": "HASH_MD5",
"value": "true"
},
{
"name": "SCAN_LARGE_FILE_READ",
"value": "false"
},
{
"name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
"value": "true"
},
{
"name": "DELAY_EXECUTE",
"value": "true"
},
{
"name": "SCAN_NETWORK_DRIVE",
"value": "false"
},
{
"name": "BYPASS_AFTER_LOGIN_MINS",
"value": "0"
},
{
"name": "BYPASS_AFTER_RESTART_MINS",
"value": "0"
},
{
"name": "SHOW_FULL_UI",
"value": "true"
},
{
"name": "SECURITY_CENTER_OPT",
"value": "false"
},
{
"name": "CB_LIVE_RESPONSE",
"value": "false"
},
{
"name": "UNINSTALL_CODE",
"value": "false"
},
{
"name": "UBS_OPT_IN",
"value": "true"
},
{
"name": "ALLOW_EXPEDITED_SCAN",
"value": "false"
},
{
"name": "RATE_LIMIT",
"value": "0"
},
{
"name": "CONNECTION_LIMIT",
"value": "0"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
}
]
},
"priorityLevel": "LOW",
"systemPolicy": false,
"version": 2
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Policy
Id Description Name Latest Revision Version Priority Level System Policy 123456 This is xsoar’s test policy after an update xsoar test1 2021-04-04T13:29:07.000Z 2 LOW false
cbd-delete-rule-from-policy
Removes a rule from an existing policy. Note: System policies cannot be modified.
Required Permissions
Live Response Permissions Required
Base Command
cbd-delete-rule-from-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
| ruleId | The rule ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-delete-rule-from-policy policyId=123456 ruleId=23
Human Readable Output
The rule was successfully deleted from the policy
Message Success Success true
cbd-find-events-results
Retrieves the result for an enriched events search request for a given job ID. By default returns 10 rows.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cbd-find-events-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. | Required |
| rows | The number of rows to request. Can be paginated. Default is 10. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Events.Results.job_id | Results | The results of the event. |
| CarbonBlackDefense.Events.Results.approximate_unaggregated | Number | The approximate number of unaggregated results. |
| CarbonBlackDefense.Events.Results.completed | Number | The number of completed results. |
| CarbonBlackDefense.Events.Results.contacted | Number | The number of contacted results. |
| CarbonBlackDefense.Events.Results.num_aggregated | Number | The number of aggregated results. |
| CarbonBlackDefense.Events.Results.num_available | Number | The number of events available in this search. |
| CarbonBlackDefense.Events.Results.num_found | Number | The number of events found in this search. |
| CarbonBlackDefense.Events.Results.results | Unknown | The lists that contains the data of the results for this search. |
Command Example
!cbd-find-events-results job_id=82d1df67-0edc-43e6-8e1b-c3dd9d42a3e9
Context Example
{
"CarbonBlackDefense": {
"Events": {
"Results": {
"job_id": "82d1df67-0edc-43e6-8e1b-c3dd9d42a3e9",
"approximate_unaggregated": 28229,
"completed": 47,
"contacted": 47,
"num_aggregated": 501,
"num_available": 500,
"num_found": 28229,
"results": [
{
"alert_category": [
"THREAT"
],
"alert_id": [
"null/50534F0D"
],
"backend_timestamp": "2021-04-04T11:09:32.762Z",
"blocked_hash": [
"2e34b3d5c820ace4f2441b25b768a460eca4492d0d1f1789791f092f3bcfb27f"
],
"blocked_name": "c:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\cr_60f73.tmp\\setup.exe",
"device_group_id": 0,
"device_id": 1234,
"device_name": "qa\\thakurabt301",
"device_policy_id": 6525,
"device_timestamp": "2021-04-04T11:08:29.978Z",
"enriched": true,
"enriched_event_type": "CREATE_PROCESS",
"event_description": "The application \"<share><link hash=\"2e34b3d5c820ace4f2441b25b768a460eca4492d0d1f1789791f092f3bcfb27f\">C:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\cr_60f73.tmp\\setup.exe</link></share>\" invoked the application \"<share><link hash=\"2e34b3d5c820ace4f2441b25b768a460eca4492d0d1f1789791f092f3bcfb27f\">C:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\cr_60f73.tmp\\setup.exe</link></share>\". The operation was <accent>blocked</accent> and the application <accent>terminated by Cb Defense</accent>.",
"event_id": "1112",
"event_type": "childproc",
"ingress_time": 1617534549464,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003ee69d-002f405c-00000000-1d72942d795d005",
"parent_pid": 3096668,
"process_guid": "7DESJ9GN-003ee69d-002f4774-00000000-1d72942d7da2d2e",
"process_hash": [
"3240e19c0dcbf7c061c8eb8b90961f12",
"2e34b3d5c820ace4f2441b25b768a460eca4492d0d1f1789791f092f3bcfb27f"
],
"process_name": "c:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\cr_60f73.tmp\\setup.exe",
"process_pid": [
3098484
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
],
"sensor_action": [
"TERMINATE"
]
},
{
"backend_timestamp": "2021-04-04T11:09:43.360Z",
"device_group_id": 0,
"device_id": 5678,
"device_name": "qa\\thakurabt301",
"device_policy_id": 6525,
"device_timestamp": "2021-04-04T11:08:29.649Z",
"enriched": true,
"enriched_event_type": "FILE_CREATE",
"event_description": "The file \"<share><link hash=\"2e34b3d5c820ace4f2441b25b768a460eca4492d0d1f1789791f092f3bcfb27f\">C:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\cr_60f73.tmp\\setup.exe</link></share>\" was first detected on a local disk. The device was off the corporate network using the public address 8.8.8.8 (located in Arvada CO, United States). The file is signed and is part of Google Chrome Installer by Google LLC. The file was created by the application \"<share><link hash=\"0b7094c2c6a97d7fb4ac08a8a03e09f0207861916eb83f4742ba9a5e73ff9846\">C:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\89.0.4389.114_chrome_installer.exe</link></share>\".",
"event_id": "1314",
"event_type": "filemod",
"ingress_time": 1617534549466,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003ee69d-002f4b98-00000000-1d72942d3429066",
"parent_pid": 3099544,
"process_guid": "7DESJ9GN-003ee69d-002f405c-00000000-1d72942d795d005",
"process_hash": [
"36da6f61efcbcca63fe0df0de8136047",
"0b7094c2c6a97d7fb4ac08a8a03e09f0207861916eb83f4742ba9a5e73ff9846"
],
"process_name": "c:\\program files (x86)\\google\\update\\install\\{29175460-7f1a-4a09-b7e9-a7feb7c2f3c3}\\89.0.4389.114_chrome_installer.exe",
"process_pid": [
3096668
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"backend_timestamp": "2021-04-04T11:02:38.137Z",
"device_group_id": 0,
"device_id": 1516,
"device_name": "vm-2k12-vg73",
"device_policy_id": 6525,
"device_timestamp": "2021-04-04T11:01:17.432Z",
"enriched": true,
"enriched_event_type": "CREATE_PROCESS",
"event_description": "The application \"<share><link hash=\"bb8b199f504db7e81cf32ce3c458d2a8533beac8dcefa5df024fa79fe132648a\">C:\\program files (x86)\\google\\chrome\\application\\chrome.exe</link></share>\" invoked the application \"<share><link hash=\"bb8b199f504db7e81cf32ce3c458d2a8533beac8dcefa5df024fa79fe132648a\">C:\\program files (x86)\\google\\chrome\\application\\chrome.exe</link></share>\". ",
"event_id": "9101",
"event_type": "childproc",
"ingress_time": 1617534118059,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003ed47a-00000fa8-00000000-1d71a59d587ee82",
"parent_pid": 4008,
"process_guid": "7DESJ9GN-003ed47a-00000e60-00000000-1d71bd519bce09f",
"process_hash": [
"aa2e522a405cb5a295d3502c4ff6ca39",
"bb8b199f504db7e81cf32ce3c458d2a8533beac8dcefa5df024fa79fe132648a"
],
"process_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"process_pid": [
3680
],
"process_username": [
"VM-2K12-VG73\\Administrator"
]
}
]
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Event Results
Event Id Device Id Event Network Remote Port Event Network Remote Ipv4 Event Network Local Ipv4 Enriched Event Type 1234 1112 CREATE_PROCESS 5678 1314 FILE_CREATE 9101 1516 CREATE_PROCESS
cbd-find-events-details
Initiates a request to retrieve detail fields for enriched events. the job_id that returns from this command can be used to get the results using the “cbd-find-events-details-results” command.
Required Permissions
RBAC Permissions Required - org.search.events: CREATE
Base Command
cbd-find-events-details
Input
| Argument Name | Description | Required |
|---|---|---|
| event_ids | A comma-separated list of event IDs to fetch. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.EventDetails.Search.job_id | String | The job ID. |
Command Example
!cbd-find-events-details event_ids=`["b5eeb4ec953411eb8af72dacb2908592"]`
Context Example
{
"CarbonBlackDefense": {
"EventDetails": {
"Search": {
"job_id": "3b7c0a61-2ef5-4541-b9bb-2389bd009d32"
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Event Details Search
Job Id 3b7c0a61-2ef5-4541-b9bb-2389bd009d32
cbd-find-events-details-results
Retrieves the status for an enriched events detail request for a given job ID.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cbd-find-events-details-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.EventDetails.Results.job_id | Results | The results of the event. |
| CarbonBlackDefense.EventDetails.Results.approximate_unaggregated | Number | The approximate number of unaggregated results. |
| CarbonBlackDefense.EventDetails.Results.completed | Number | The number of completed results. |
| CarbonBlackDefense.EventDetails.Results.contacted | Number | The number of contacted results. |
| CarbonBlackDefense.EventDetails.Results.num_aggregated | Number | The number of aggregated results. |
| CarbonBlackDefense.EventDetails.Results.num_available | Number | The number of event details available in this search. |
| CarbonBlackDefense.EventDetails.Results.num_found | Number | The number of event details found in this search. |
| CarbonBlackDefense.EventDetails.Results.results | Unknown | The lists that contains the data of the results for this search. |
Command Example
!cbd-find-events-details-results job_id=ee9d8548-e356-45b5-97e5-307713a56e26
Context Example
{
"CarbonBlackDefense": {
"EventDetails": {
"Results": {
"job_id": "ee9d8548-e356-45b5-97e5-307713a56e26",
"approximate_unaggregated": 1,
"completed": 46,
"contacted": 46,
"num_aggregated": 1,
"num_available": 1,
"num_found": 1,
"results": [
{
"backend_timestamp": "2021-03-21T15:16:41.491Z",
"device_external_ip": "3.3.3.3",
"device_group_id": 0,
"device_id": 5678,
"device_installed_by": "TestSecDomain.test\\Administrator",
"device_internal_ip": "2.2.2.2",
"device_location": "OFFSITE",
"device_name": "testsecdomain\\win-tv9ubklp1kn",
"device_os": "WINDOWS",
"device_os_version": "Server 2012 R2 x64",
"device_policy": "default",
"device_policy_id": 6525,
"device_target_priority": "LOW",
"device_timestamp": "2021-03-21T15:10:35.067Z",
"document_guid": "1a2b3c4d",
"enriched": true,
"enriched_event_type": "NETWORK",
"event_description": "The application \"<share><link hash=\"c52b1e17afe7a2b956250c264883f6560aa5801db347f31f6845c592ef15a3a0\">C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe</link></share>\" established a <accent>UDP/443</accent> connection to <share><accent>1.1.1.1</accent></share><accent>:80</accent> (<share><accent>clientservices.googleapis.com</accent></share>, located in United States) from <share><accent>2.2.2.2</accent></share><accent>:52527</accent>. The device was off the corporate network using the public address <accent>8.8.8.8</accent> (<accent>WIN-TV9UBKLP1KN.TestSecDomain.test</accent>, located in Columbus OH, United States). The operation was successful.",
"event_id": "1234",
"event_network_inbound": false,
"event_network_local_ipv4": "1.1.1.1",
"event_network_location": ",,United States",
"event_network_protocol": "UDP",
"event_network_remote_ipv4": "8.8.8.8",
"event_network_remote_port": 443,
"event_threat_score": [
0
],
"event_type": "netconn",
"ingress_time": 1616339792243,
"legacy": true,
"netconn_domain": "clientservices..googleapis..com",
"netconn_inbound": false,
"netconn_ipv4": -1395063613,
"netconn_local_ipv4": 167830793,
"netconn_local_port": 52527,
"netconn_location": ",,United States",
"netconn_port": 443,
"netconn_protocol": "PROTO_UDP",
"org_id": "7DESJ9GN",
"parent_cmdline": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" ",
"parent_cmdline_length": 62,
"parent_effective_reputation": "TRUSTED_WHITE_LIST",
"parent_guid": "7DESJ9GN-000ca144-00001388-00000000-1d660f262b3d3f2",
"parent_hash": [
"c52b1e17afe7a2b956250c264883f6560aa5801db347f31f6845c592ef15a3a0"
],
"parent_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"parent_pid": 5000,
"parent_reputation": "TRUSTED_WHITE_LIST",
"process_cmdline": [
"\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1184,13396929298740803928,12863694328792823850,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox/prefetch:8"
],
"process_cmdline_length": [
322
],
"process_effective_reputation": "TRUSTED_WHITE_LIST",
"process_guid": "7DESJ9GN-000ca144-000018a4-00000000-1d660f264a17328",
"process_hash": [
"5cf2e72aee581b5e3d16ff1d5c626fc6",
"c52b1e17afe7a2b956250c264883f6560aa5801db347f31f6845c592ef15a3a0"
],
"process_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
"process_pid": [
6308
],
"process_reputation": "TRUSTED_WHITE_LIST",
"process_sha256": "1a2b3c4d",
"process_start_time": "2020-07-23T13:08:44.066Z",
"process_username": [
"TESTSECDOMAIN\\Administrator"
],
"ttp": [
"NETWORK_ACCESS"
]
}
]
}
}
}
}
Human Readable Output
Carbon Black Endpoint Standard Event Details Results
Event Id Device Id Event Network Remote Port Event Network Remote Ipv4 Event Network Local Ipv4 Enriched Event Type 1234 5678 80 8.8.8.8 1.1.1.1 NETWORK
cbd-device-quarantine
Quarantines the device. Not supported for devices in a Linux operating system.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cbd-device-quarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-quarantine device_id=123456
Human Readable Output
Device quarantine successfully
cbd-device-unquarantine
Unquarantines the device. Not supported for devices in a Linux operating system.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cbd-device-unquarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-unquarantine device_id=123456
Human Readable Output
Device unquarantine successfully
cbd-device-background-scan
Starts a background scan on the device. Not supported for devices in a Linux operating system.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cbd-device-background-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-background-scan device_id=123456
Human Readable Output
Background scan started successfully
cbd-device-background-scan-stop
Stops a background scan on the device. Not supported for devices in a Linux operating system.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cbd-device-background-scan-stop
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-background-scan-stop device_id=123456
Human Readable Output
Background scan stopped successfully
cbd-device-bypass
Bypasses a device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cbd-device-bypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-bypass device_id=123456
Human Readable Output
Device bypass successfully
cbd-device-unbypass
Unbypasses a device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cbd-device-unbypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-unbypass device_id=123456
Human Readable Output
Device unbypass successfully
cbd-device-policy-update
Updates the devices to the specified policy ID.
Required Permissions
RBAC Permissions Required - device.policy: UPDATE
Base Command
cbd-device-policy-update
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
| policy_id | The ID of the policy. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-policy-update device_id=123456 policy_id=123456
Human Readable Output
Policy updated successfully
cbd-device-update-sensor-version
Updates the version of a sensor.
Required Permissions
RBAC Permissions Required - device.kits: EXECUTE
Base Command
cbd-device-update-sensor-version
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
| sensor_version | The new version of the sensor. For example: { “MAC”: “1.2.3.4” }. Supported types: XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX. Possible values are: {“XP”:}, {“WINDOWS”:}, {“MAC”:}, {“AV_SIG”:}, {“OTHER”:}, {“RHEL”:}, {“UBUNTU”:}, {“SUSE”:}, {“AMAZON_LINUX”:}, {“MAC_OSX”:}. | Required |
Context Output
There is no context output for this command.
Command Example
!cbd-device-update-sensor-version device_id=123456 sensor_version={\"AMAZON_LINUX\":\"1.2.3.4\"}
Human Readable Output
Version update to {“AMAZON_LINUX”:”1.2.3.4”} was successful
cbd-alerts-search
Gets details on the events that led to an alert. This includes retrieving metadata around the alert as well as the event associated with the alert.
Required Permissions
RBAC Permissions Required - org.alerts: READ
Base Command
cbd-alerts-search
Input
| Argument Name | Description | Required |
|---|---|---|
| type | The type of the alerts. Possible values: “cbAnalytics”, “devicecontrol”, “all”. Possible values are: cbanalytics, devicecontrol, all. | Optional |
| category | The category of the alert. Possible values: “THREAT”, “MONITORED”. Possible values are: THREAT, MONITORED. | Optional |
| device_id | The device ID. | Optional |
| first_event_time | The time of the first event associated with the alert. The syntax is {“start”: “<dateTime>”, “range”: “<string>”, “end”: “<dateTime>” }. For example: { “start”: “2010-09-25T00:10:50.277Z”, “end”: “2015-01-20T10:40:00.00Z”}. | Optional |
| policy_id | The policy ID. | Optional |
| process_sha256 | The SHA-256 hash of the primary involved process. | Optional |
| reputation | The reputation of the primary involved process. Possible values: “KNOWN_MALWARE”, “NOT_LISTED”, etc. | Optional |
| tag | The tags associated with the alert. | Optional |
| device_username | The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of results to be returned. | Optional |
| start | The number of the alert from where to start retrieving results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Alert.id | String | The identifier for the alert. |
| CarbonBlackDefense.Alert.legacy_alert_id | String | The unique short ID for the alerts to support easier consumption in the UI console. Use the ID for API requests. |
| CarbonBlackDefense.Alert.org_key | String | The unique identifier for the organization associated with the alert. |
| CarbonBlackDefense.Alert.create_time | Date | The time the alert was created. |
| CarbonBlackDefense.Alert.last_update_time | Date | The last time the alert was updated. |
| CarbonBlackDefense.Alert.first_event_time | Date | The time of the first event associated with the alert. |
| CarbonBlackDefense.Alert.last_event_time | Date | The time of the latest event associated with the alert. |
| CarbonBlackDefense.Alert.threat_id | String | The identifier of a threat that this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices. |
| CarbonBlackDefense.Alert.severity | Number | The threat ranking of the alert. |
| CarbonBlackDefense.Alert.category | String | The category of the alert. (THREAT, MONITORED). |
| CarbonBlackDefense.Alert.device_id | Number | The identifier assigned by Carbon Black Cloud to the device associated with the alert. |
| CarbonBlackDefense.Alert.device_os | String | The operating system of the device associated with the alert. |
| CarbonBlackDefense.Alert.device_os_version | String | The operating system and version on the device. |
| CarbonBlackDefense.Alert.device_name | String | The hostname of the device associated with the alert. |
| CarbonBlackDefense.Alert.device_username | String | The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner. |
| CarbonBlackDefense.Alert.policy_id | Number | The identifier for the policy associated with the device at the time of the alert. |
| CarbonBlackDefense.Alert.policy_name | String | The name of the policy associated with the device at the time of the alert. |
| CarbonBlackDefense.Alert.target_value | String | The priority of the device assigned by the policy. |
| CarbonBlackDefense.Alert.workflow.state | String | The state of the tracking system for alerts as they are triaged and resolved. Supported states are OPEN or DISMISSED. |
| CarbonBlackDefense.Alert.workflow.remediation | String | The state of the workflow of the tracking system for alerts as they are triaged and resolved. Supported states are OPEN or DISMISSED. |
| CarbonBlackDefense.Alert.workflow.last_update_time | Date | The last time the alert was updated. |
| CarbonBlackDefense.Alert.workflow.comment | String | The comment about the workflow of the tracking system for alerts as they are triaged and resolved. |
| CarbonBlackDefense.Alert.workflow.changed_by | String | The name of the user who changed the alert. |
| CarbonBlackDefense.Alert.notes_present | Boolean | Indicates if notes are associated with the threat ID. |
| CarbonBlackDefense.Alert.tags | Unknown | Tags associated with the alert ([ “tag1”, “tag2” ]). |
| CarbonBlackDefense.Alert.reason | String | The description of the alert. |
| CarbonBlackDefense.Alert.count | Number | The count of the alert. |
| CarbonBlackDefense.Alert.report_id | String | The identifier of the report that contains the IOC. |
| CarbonBlackDefense.Alert.report_name | String | The name of the report that contains the IOC. |
| CarbonBlackDefense.Alert.ioc_id | String | The identifier of the IOC that cause the hit. |
| CarbonBlackDefense.Alert.ioc_field | String | The indicator of comprise (IOC) field that the hit contains. |
| CarbonBlackDefense.Alert.ioc_hit | String | IOC field value or IOC that matches the query. |
| CarbonBlackDefense.Alert.watchlists.id | String | The ID of the watchlists associated with an alert. |
| CarbonBlackDefense.Alert.watchlists.name | String | The name of the watchlists associated with an alert. |
| CarbonBlackDefense.Alert.process_guid | String | The global unique identifier of the process that triggered the hit. |
| CarbonBlackDefense.Alert.process_name | String | The name of the process that triggered the hit. |
| CarbonBlackDefense.Alert.run_state | String | Run state for watchlist alerts. This value is always “RAN”. |
| CarbonBlackDefense.Alert.threat_indicators.process_name | String | The name of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_indicators.sha256 | String | The SHA-256 hash of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_indicators.ttps | String | The tactics, techniques, and procedures (TTPs) of the threat indicators that make up the threat. |
| CarbonBlackDefense.Alert.threat_cause_actor_sha256 | String | The SHA-256 hash of the threat cause actor. |
| CarbonBlackDefense.Alert.threat_cause_actor_md5 | String | The SHA-256 hash of the threat cause actor. |
| CarbonBlackDefense.Alert.threat_cause_actor_name | String | Process name or IP address of the threat actor. |
| CarbonBlackDefense.Alert.threat_cause_reputation | String | The reputation of the threat cause. (KNOWN_MALWARE, SUSPECT_MALWARE, PUP, NOT_LISTED, ADAPTIVE_WHITE_LIST, COMMON_WHITE_LIST, TRUSTED_WHITE_LIST, COMPANY_BLACK_LIST). |
| CarbonBlackDefense.Alert.threat_cause_threat_category | String | The category of the threat cause. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.threat_cause_vector | String | The source of the threat cause. (EMAIL, WEB, GENERIC_SERVER, GENERIC_CLIENT, REMOTE_DRIVE, REMOVABLE_MEDIA, UNKNOWN, APP_STORE, THIRD_PARTY). |
| CarbonBlackDefense.Alert.document_guid | String | The document GUID. |
| CarbonBlackDefense.Alert.type | String | The type of alert. (CB_ANALYTICS, DEVICE_CONTROL). |
| CarbonBlackDefense.Alert.reason_code | String | The shorthand enum for the full-text reason. |
| CarbonBlackDefense.Alert.device_location | String | Whether the device was on-premise or off-premise when the alert started. (ONSITE, OFFSITE, UNKNOWN). |
| CarbonBlackDefense.Alert.created_by_event_id | String | Event identifier that initiated the alert. |
| CarbonBlackDefense.Alert.threat_activity_dlp | String | Whether the alert involved data loss prevention (DLP). (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_activity_phish | String | Whether the alert involved phishing. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_activity_c2 | String | Whether the alert involved a command and control (c2) server. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED). |
| CarbonBlackDefense.Alert.threat_cause_actor_process_pid | String | The process identifier (PID) of the actor process. |
| CarbonBlackDefense.Alert.threat_cause_process_guid | String | The GUID of the process. |
| CarbonBlackDefense.Alert.threat_cause_parent_guid | String | The parent GUID of the process. |
| CarbonBlackDefense.Alert.threat_cause_cause_event_id | String | The threat cause cause event ID. |
| CarbonBlackDefense.Alert.blocked_threat_category | String | The category of threat which we were able to take action on. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.not_blocked_threat_category | String | Other potentially malicious activity involved in the threat on which we weren’t able to take action (either due to policy config, or not having a relevant rule). (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM). |
| CarbonBlackDefense.Alert.kill_chain_status | String | The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. (RECONNAISSANCE, WEAPONIZE, DELIVER_EXPLOIT, INSTALL_RUN, COMMAND_AND_CONTROL, EXECUTE_GOAL, BREACH). For example [ “EXECUTE_GOAL”, “BREACH” ]. |
| CarbonBlackDefense.Alert.sensor_action | String | The action taken by the sensor, according to the rule of the policy. (POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY). |
| CarbonBlackDefense.Alert.policy_applied | String | Whether a policy was applied. (APPLIED, NOT_APPLIED). |
Command Example
#### Context Example
```json
{
"CarbonBlackDefense": {
"Alert": [
{
"blocked_threat_category": "NON_MALWARE",
"category": "THREAT",
"create_time": "2021-04-04T13:28:21.393Z",
"created_by_event_id": "9a486945954911eb8af72dacb2908592",
"device_id": 1234,
"device_location": "OFFSITE",
"device_name": "QA\\win2k16-vg6-11",
"device_os": "WINDOWS",
"device_os_version": "Windows Server 2016 x64",
"device_username": "jon@example.com",
"first_event_time": "2021-04-04T13:27:23.948Z",
"id": "1234",
"kill_chain_status": [
"INSTALL_RUN"
],
"last_event_time": "2021-04-04T13:27:23.948Z",
"last_update_time": "2021-04-04T13:28:36.264Z",
"legacy_alert_id": "DD229360",
"not_blocked_threat_category": "UNKNOWN",
"notes_present": false,
"org_key": "7DESJ9GN",
"policy_applied": "APPLIED",
"policy_id": 6525,
"policy_name": "default",
"process_name": "setup.exe",
"reason": "The application setup.exe invoked another application (setup.exe). A Deny Policy Action was applied.",
"reason_code": "T_POL_TERM_CHILD : (setup.exe)",
"run_state": "RAN",
"sensor_action": "TERMINATE",
"severity": 2,
"tags": null,
"target_value": "LOW",
"threat_activity_c2": "NOT_ATTEMPTED",
"threat_activity_dlp": "NOT_ATTEMPTED",
"threat_activity_phish": "NOT_ATTEMPTED",
"threat_cause_actor_name": "setup.exe",
"threat_cause_actor_process_pid": "14788-132620164432947360-0",
"threat_cause_actor_sha256": "1a2b3c4d",
"threat_cause_cause_event_id": "9a486945954911eb8af72dacb2908592",
"threat_cause_parent_guid": "7DESJ9GN-003edc7f-00003aac-00000000-1d71680ea0a0258",
"threat_cause_process_guid": "7DESJ9GN-003edc7f-00003368-00000000-1d71680eade2d79",
"threat_cause_reputation": "TRUSTED_WHITE_LIST",
"threat_cause_threat_category": "NON_MALWARE",
"threat_cause_vector": "UNKNOWN",
"threat_id": "61b743fdb6725ab9861f50d5e05a2e33",
"threat_indicators": [
{
"process_name": "setup.exe",
"sha256": "1a2b3c4d",
"ttps": [
"POLICY_DENY"
]
}
],
"type": "CB_ANALYTICS",
"workflow": {
"changed_by": "Carbon Black",
"comment": null,
"last_update_time": "2021-04-04T13:28:21.393Z",
"remediation": null,
"state": "OPEN"
}
},
{
"category": "THREAT",
"count": 0,
"create_time": "2021-04-04T13:28:06.812Z",
"device_id": 5678,
"device_name": "cb-komand-w12",
"device_os": "WINDOWS",
"device_os_version": null,
"device_username": "jon@example.com",
"document_guid": "1a2b3c4d",
"first_event_time": "2021-04-04T13:26:31.733Z",
"id": "5678",
"ioc_field": null,
"ioc_hit": "((netconn_port:5355 device_os:WINDOWS)) -enriched:true",
"ioc_id": "565633-0",
"last_event_time": "2021-04-04T13:26:31.733Z",
"last_update_time": "2021-04-04T13:28:06.812Z",
"legacy_alert_id": "ABCD-1234",
"notes_present": false,
"org_key": "7DESJ9GN",
"policy_id": 6525,
"policy_name": "default",
"process_guid": "7DESJ9GN-0034e348-000003d4-00000000-1d720e5cd39e19a",
"process_name": "svchost.exe",
"reason": "Process svchost.exe was detected by the report \"Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected\" in watchlist \"ATT&CK Framework\"",
"report_id": "ABCD-1234",
"report_name": "Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected",
"run_state": "RAN",
"severity": 1,
"tags": null,
"target_value": "LOW",
"threat_cause_actor_md5": "ede27eace742ee2888c5dd36400a2ec0",
"threat_cause_actor_name": "c:\\windows\\system32\\svchost.exe",
"threat_cause_actor_sha256": "1a2b3c4d",
"threat_cause_reputation": "TRUSTED_WHITE_LIST",
"threat_cause_threat_category": "UNKNOWN",
"threat_cause_vector": "UNKNOWN",
"threat_id": "8E4CE676E9C9EEF4F94065D009B66094",
"threat_indicators": [
{
"process_name": "svchost.exe",
"sha256": "1a2b3c4d",
"ttps": [
"565633-0"
]
}
],
"type": "WATCHLIST",
"watchlists": [
{
"id": "1234",
"name": "ATT&CK Framework"
}
],
"workflow": {
"changed_by": "Carbon Black",
"comment": null,
"last_update_time": "2021-04-04T13:27:32.279Z",
"remediation": null,
"state": "OPEN"
}
},
{
"category": "THREAT",
"count": 0,
"create_time": "2021-04-04T13:28:05.399Z",
"device_id": 9101,
"device_name": "EXAMPLE-INC\\Win10",
"device_os": "WINDOWS",
"device_os_version": null,
"device_username": "office@net.com",
"document_guid": "1a2b3c4d",
"first_event_time": "2021-04-04T13:26:08.028Z",
"id": "9101",
"ioc_field": null,
"ioc_hit": "((netconn_port:5355 device_os:WINDOWS)) -enriched:true",
"ioc_id": "565633-0",
"last_event_time": "2021-04-04T13:26:08.028Z",
"last_update_time": "2021-04-04T13:28:05.399Z",
"legacy_alert_id": "ABCD-1234",
"notes_present": false,
"org_key": "7DESJ9GN",
"policy_id": 6525,
"policy_name": "default",
"process_guid": "7DESJ9GN-003b4a13-000004c4-00000000-1d71527c98244b0",
"process_name": "svchost.exe",
"reason": "Process svchost.exe was detected by the report \"Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected\" in watchlist \"ATT&CK Framework\"",
"report_id": "ABCD-1234",
"report_name": "Credential Access - LLMNR/NBT-NS Poisoning - LLMNR Traffic Detected",
"run_state": "RAN",
"severity": 1,
"tags": null,
"target_value": "LOW",
"threat_cause_actor_md5": "f586835082f632dc8d9404d83bc16316",
"threat_cause_actor_name": "c:\\windows\\system32\\svchost.exe",
"threat_cause_actor_sha256": "1a2b3c4d",
"threat_cause_reputation": "TRUSTED_WHITE_LIST",
"threat_cause_threat_category": "UNKNOWN",
"threat_cause_vector": "UNKNOWN",
"threat_id": "8E4CE676E9C9EEF4F94065D009B66094",
"threat_indicators": [
{
"process_name": "svchost.exe",
"sha256": "1a2b3c4d",
"ttps": [
"565633-0"
]
}
],
"type": "WATCHLIST",
"watchlists": [
{
"id": "1234",
"name": "ATT&CK Framework"
}
],
"workflow": {
"changed_by": "Carbon Black",
"comment": null,
"last_update_time": "2021-04-04T13:27:32.279Z",
"remediation": null,
"state": "OPEN"
}
}
]
}
}
Human Readable Output
Carbon Black Endpoint Standard Alerts List Results
Id Category Device Id Device Name Device Username Create Time Ioc Hit Policy Name Process Name Type Severity 1234 THREAT 1234 QA\win2k16-vg6-11 jon@example.com 2021-04-04T13:28:21.393Z default setup.exe CB_ANALYTICS 2 5678 THREAT 5678 cb-komand-w12 jon@example.com 2021-04-04T13:28:06.812Z ((netconn_port:5355 device_os:WINDOWS)) -enriched:true default svchost.exe WATCHLIST 1 9101 THREAT 9101 BITGLASS-INC\Win10 office@net.com 2021-04-04T13:28:05.399Z ((netconn_port:5355 device_os:WINDOWS)) -enriched:true default svchost.exe WATCHLIST 1
Configuration parameters
url— URL (required)custom_credentials— Custom Api Key (using for API version 6)live_response_credentials— Api Key (Api/Live Response key using for API version 3)organization_key— Organization KeyincidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidentsinsecure— Trust any certificate (not secure)proxy— Use system proxy settingssuffix_url_path— The type of the alertcategory— The category of the alert.device_id— Device idpolicy_id— Policy iddevice_username— Device usernamemin_severity— Minimum severityquery— Queryfirst_fetch— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).max_fetch— Maximum number of incidents per fetch
Commands (26)
-
cbd-add-rule-to-policyAdds a new rule to an existing policy. Note: System policies cannot be modified.
-
cbd-alerts-searchGets details on the events that led to an alert. This includes retrieving metadata around the alert as well as the event associated with the alert.
-
cbd-create-policyCreates a new policy on the CB Defense backend.
-
cbd-delete-policyDeletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.
-
cbd-delete-rule-from-policyRemoves a rule from an existing policy. Note: System policies cannot be modified.
-
cbd-device-background-scanStarts a background scan on the device. Not supported for devices in a Linux operating system.
-
cbd-device-background-scan-stopStops a background scan on the device. Not supported for devices in a Linux operating system.
-
cbd-device-bypassBypasses a device.
-
cbd-device-policy-updateUpdates the devices to the specified policy ID.
-
cbd-device-quarantineQuarantines the device. Not supported for devices in a Linux operating system.
-
cbd-device-searchSearches devices in your organization.
-
cbd-device-unbypassUnbypasses a device.
-
cbd-device-unquarantineUnquarantines the device. Not supported for devices in a Linux operating system.
-
cbd-device-update-sensor-versionUpdates the version of a sensor.
-
cbd-find-eventsCreates an enriched events search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, time_range) is required).
-
cbd-find-events-detailsInitiates a request to retrieve detail fields for enriched events. the job_id that returns from this command can be used to get the results using the "cbd-find-events-details-results" command.
-
cbd-find-events-details-resultsRetrieves the status for an enriched events detail request for a given job ID.
-
cbd-find-events-resultsRetrieves the result for an enriched events search request for a given job ID. By default returns 10 rows.
-
cbd-find-processesCreates a process search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, and time_range) is required.
-
cbd-find-processes-resultsRetrieves the results of a process search identified by the job ID.
-
cbd-get-alert-detailsGet details about the events that led to an alert by its ID. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
-
cbd-get-policiesGets the list of policies available in your organization.
-
cbd-get-policyRetrieves a policy object by ID.
-
cbd-set-policyResets policy fields.
-
cbd-update-policyUpdates an existing policy with a new policy. Note: System policies cannot be modified.
-
cbd-update-rule-in-policyUpdates an existing rule with a new rule. Note: System policies cannot be modified.
import json from typing import Any import demistomock as demisto import urllib3 from CommonServerPython import * # noqa # pylint: disable=unused-wildcard-import from CommonServerUserPython import * # noqa # Disable insecure warnings urllib3.disable_warnings() # pylint: disable=no-member """ CONSTANTS """ DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" # ISO8601 format with UTC, default in XSOAR MAX_INCIDENTS_TO_FETCH = 50 CURRENT_VERSION_OF_THE_POLICY_API = 2 # this is the current version of the policy api COMMAND_NOT_IMPELEMENTED_MSG = "Command not implemented" """ CLIENT CLASS """ class Client(BaseClient): """Client class to interact with the service API This Client implements API calls, and does not contain any XSOAR logic. Should only do requests and return data. It inherits from BaseClient defined in CommonServer Python. Most calls use _http_request() that handles proxy, SSL verification, etc. For this implementation, no special attributes defined """ def __init__( self, base_url, verify, proxies, api_key, api_secret_key, policy_api_key, policy_api_secret_key, organization_key ): self.base_url = base_url self.verify = verify self.proxies = proxies self.api_key = api_key self.api_secret_key = api_secret_key self.policy_api_key = policy_api_key self.policy_api_secret_key = policy_api_secret_key self.organization_key = organization_key self.headers = {"X-Auth-Token": f"{api_secret_key}/{api_key}", "Content-Type": "application/json"} self.policy_headers = {"X-Auth-Token": f"{policy_api_secret_key}/{policy_api_key}", "Content-Type": "application/json"} super().__init__(base_url, verify, proxies) def test_module_request(self) -> dict: """Tests connectivity with the application, for some API's. :return: A list of alerts. :rtype: ``Dict[str, any]`` """ suffix_url = f"appservices/v6/orgs/{self.organization_key}/alerts/_search" return self._http_request("POST", url_suffix=suffix_url, headers=self.headers, json_data={}) def policy_test_module_request(self) -> dict: """Tests connectivity with the application, for Policy API. :return: A list of policies. :rtype: ``Dict[str, any]`` """ suffix_url = "integrationServices/v3/policy" return self._http_request("GET", url_suffix=suffix_url, headers=self.policy_headers) def search_alerts_request( self, suffix_url_path: str = None, minimum_severity: int = None, create_time: dict = None, policy_id: List = None, device_username: List = None, device_id: List = None, query: str = None, alert_category: List = None, sort_field: str = "create_time", sort_order: str = "ASC", limit: int = 50, ) -> dict: """Searches for Carbon Black alerts using the '/appservices/v6/orgs/{org_key}/alerts/_search' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type suffix_url_path: ``Optional[str]`` :param suffix_url_path: type of the alert to search for. Options are: 'all' or 'cbanalytics' or 'devicecontrol' :type minimum_severity: ``Optional[int]`` :param minimum_severity: the minimum severity of the alert to search for. :type create_time: ``Optional[Dict]`` :param create_time: A dict presented the the time the alert was created. The syntax is {"start": "<dateTime>", "range": "<string>", "end": "<dateTime>" }. For example: {"start": "2010-09-25T00:10:50.00", "end": "2015-01-20T10:40:00.00Z", "range": "-1d"}. (s for seconds, m for minutes, h for hours, d for days, w for weeks, y for years). :type policy_id: ``Optional[list]`` :param policy_id: The identifier for the policy associated with the device at the time of the alert. :type device_username: ``Optional[list]`` :param device_username: The username of the logged on user during the alert. If the user is not available then it may be populated with the device owner :type device_id: ``Optional[list]`` :param device_id: The identifier assigned by Carbon Black Cloud to the device associated with the alert. :type query: ``Optional[str]`` :param query: Query in lucene syntax and/or including value searches. :type alert_category: ``Optional[list]`` :param alert_category: The category of the alert. Options are: 'THREAT' or 'MONITORED' :type sort_field: ``Optional[str]`` :param sort_field: The field to sort by it :type sort_order: ``Optional[str]`` :param sort_order: The sort order (ASC, DESC) :type limit: ``Optional[int]`` :param limit: The number of results to return. default is 50. :return: Dict containing a List with the found Carbon Black alerts as dicts :rtype: ``Dict[str, Any]`` """ if not suffix_url_path or suffix_url_path == "all": suffix_url = f"appservices/v6/orgs/{self.organization_key}/alerts/_search" else: suffix_url = f"appservices/v6/orgs/{self.organization_key}/alerts/{suffix_url_path}/_search" body = { "criteria": assign_params( minimum_severity=minimum_severity, create_time=create_time, policy_id=policy_id, device_username=device_username, device_id=device_id, category=alert_category, ), "sort": [{"field": sort_field, "order": sort_order}], "rows": limit, } if query: body["query"] = query return self._http_request("POST", suffix_url, headers=self.headers, json_data=body) # Policies API def create_new_policy(self, name: str = None, description: str = None, priority_level: str = None, policy: dict = None): """Creates a new Carbon Black policy using the 'integrationServices/v3/policy' API endpoint :type name: ``Optional[str]`` :param name: The name of the new policy. :type description: ``Optional[str]`` :param description: A description of the policy. :type priority_level: ``Optional[str]`` :param priority_level: The priority score associated with sensors assigned to this policy. Options are: 'HIGH' or 'MEDIUM' or 'LOW'. :type policy: ``Optional[dict]`` :param policy: A JSON object containing the policy details. :return: A dict containing the new policy ID'. :rtype: ``dict`` """ suffix_url = "integrationServices/v3/policy" body = { "policyInfo": assign_params( name=name, description=description, priorityLevel=priority_level, policy=policy, version=CURRENT_VERSION_OF_THE_POLICY_API, ) } return self._http_request(method="POST", url_suffix=suffix_url, headers=self.policy_headers, json_data=body) def get_policies(self): """Searches for Carbon Black policies using the 'integrationServices/v3/policy' API endpoint :return: A dict containing all policies'. :rtype: ``dict`` """ suffix_url = "integrationServices/v3/policy" return self._http_request(method="GET", url_suffix=suffix_url, headers=self.policy_headers) def get_policy_by_id(self, policy_id: int = None): """Returns Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :return: dict containing the policy data'. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}" return self._http_request(method="GET", url_suffix=suffix_url, headers=self.policy_headers) def set_policy(self, policy_id: int = None, policy_info: dict = None): """Updates Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :type policy_info: ``Optional[dict]`` :param policy_info: A JSON object containing the policy details. :return: A dict containing information about the success / failure of the update. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}" return self._http_request(method="PUT", url_suffix=suffix_url, headers=self.policy_headers, json_data=policy_info) def update_policy( self, policy_id: int = None, name: str = None, description: str = None, priority_level: str = None, policy: dict = None ): """Updates Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :type name: ``Optional[str]`` :param name: The name of the new policy. :type description: ``Optional[str]`` :param description: A description of the policy. :type priority_level: ``Optional[str]`` :param priority_level: The priority score associated with sensors assigned to this policy. Options are: 'HIGH' or 'MEDIUM' or 'LOW'. :type policy: ``Optional[dict]`` :param policy: A JSON object containing the policy details. :return: A dict containing information about the success / failure of the update. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}" body = assign_params( policyInfo=assign_params( id=policy_id, name=name, description=description, priorityLevel=priority_level, policy=policy, version=CURRENT_VERSION_OF_THE_POLICY_API, ) ) return self._http_request(method="PUT", url_suffix=suffix_url, headers=self.policy_headers, json_data=body) def delete_policy(self, policy_id: int = None): """Deletes Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :return: A dict containing information about the success / failure of the deletion. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}" return self._http_request(method="DELETE", url_suffix=suffix_url, headers=self.policy_headers) def add_rule_to_policy( self, policy_id: int = None, action: str = None, operation: str = None, required: str = None, type: str = None, value: str = None, ): """Adds a rule to a Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}/rule' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :type action: ``Optional[str]`` :param action: The rule action. Options are: 'true' or 'false'. Options are: 'TERMINATE' or 'IGNORE' or 'TERMINATE_THREAD' or 'ALLOW' or 'DENY' or 'TERMINATE_PROCESS' :type operation: ``Optional[str]`` :param operation: The rule operation. Options are: 'MODIFY_SYSTEM_EXE' or 'PASSTHRU' or 'CRED' or 'RANSOM' or 'NETWORK_SERVER' or 'POL_INVOKE_NOT_TRUSTED' or 'IMPERSONATE' or 'MICROPHONE_CAMERA' or 'INVOKE_SYSAPP' or 'NETWORK_CLIENT' or 'BYPASS_REG' or 'BUFFER_OVERFLOW' or 'BYPASS_API' or 'USER_DOC' or 'CODE_INJECTION' or 'BYPASS_NET' or 'KEYBOARD' or 'BYPASS_ALL' or 'RUN' or 'INVOKE_CMD_INTERPRETER' or 'MODIFY_SYTEM_CONFIG' or 'ESCALATE' or 'BYPASS_FILE' or 'RUN_AS_ADMIN' or 'BYPASS_PROCESS' or 'NETWORK' or 'KERNEL_ACCESS' or 'NETWORK_PEER' or 'PACKED' or 'INVOKE_SCRIPT' or 'MEMORY_SCRAPE' or 'BYPASS_SELF_PROTECT' or 'TAMPER_API' :type required: ``Optional[bool]`` :param required: Is the rule required. Options are: 'true' or 'false'. :type type: ``Optional[dict]`` :param type: The application type. Options are: 'REPUTATION' or 'SIGNED_BY' or 'NAME_PATH'. :type value: ``Optional[dict]`` :param value: The application value. :return: A dict containing the new rule ID. and also information about the success / failure of the update. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}/rule" body = { "ruleInfo": assign_params( action=action, operation=operation, required=required, application=assign_params(type=type, value=value) ) } return self._http_request(method="POST", url_suffix=suffix_url, headers=self.policy_headers, json_data=body) def update_rule_in_policy( self, policy_id: int = None, action: str = None, operation: str = None, required: str = None, rule_id: int = None, type: str = None, value: str = None, ): """Updates a rule in a Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}/rule{rule_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :type action: ``Optional[str]`` :param action: The rule action. Options are: 'true' or 'false'. Options are: 'TERMINATE' or 'IGNORE' or 'TERMINATE_THREAD' or 'ALLOW' or 'DENY' or 'TERMINATE_PROCESS' :type operation: ``Optional[str]`` :param operation: The rule operation. Options are: 'MODIFY_SYSTEM_EXE' or 'PASSTHRU' or 'CRED' or 'RANSOM' or 'NETWORK_SERVER' or 'POL_INVOKE_NOT_TRUSTED' or 'IMPERSONATE' or 'MICROPHONE_CAMERA' or 'INVOKE_SYSAPP' or 'NETWORK_CLIENT' or 'BYPASS_REG' or 'BUFFER_OVERFLOW' or 'BYPASS_API' or 'USER_DOC' or 'CODE_INJECTION' or 'BYPASS_NET' or 'KEYBOARD' or 'BYPASS_ALL' or 'RUN' or 'INVOKE_CMD_INTERPRETER' or 'MODIFY_SYTEM_CONFIG' or 'ESCALATE' or 'BYPASS_FILE' or 'RUN_AS_ADMIN' or 'BYPASS_PROCESS' or 'NETWORK' or 'KERNEL_ACCESS' or 'NETWORK_PEER' or 'PACKED' or 'INVOKE_SCRIPT' or 'MEMORY_SCRAPE' or 'BYPASS_SELF_PROTECT' or 'TAMPER_API' :type required: ``Optional[bool]`` :param required: Is the rule required. Options are: 'true' or 'false'. :type rule_id: ``Optional[int]`` :param rule_id: Is the rule id. :type type: ``Optional[dict]`` :param type: A JSON object containing the policy details. :type value: ``Optional[dict]`` :param value: A JSON object containing the policy details. :return: A dict containing information about the success / failure of the update. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}/rule/{rule_id}" body = { "ruleInfo": assign_params( action=action, operation=operation, required=required, id=rule_id, application=assign_params(type=type, value=value), ) } return self._http_request(method="PUT", url_suffix=suffix_url, headers=self.policy_headers, json_data=body) def delete_rule_from_policy(self, policy_id: int = None, rule_id: int = None): """Deletes a rule of Carbon Black policy by ID using the 'integrationServices/v3/policy/{policy_id}/rule/{rule_id}' API endpoint :type policy_id: ``Optional[int]`` :param policy_id: The id of the policy. :type rule_id: ``Optional[int]`` :param rule_id: The id of the rule. :return: A dict containing information about the success / failure of the deletion. :rtype: ``dict`` """ suffix_url = f"integrationServices/v3/policy/{policy_id}/rule/{rule_id}" return self._http_request(method="DELETE", url_suffix=suffix_url, headers=self.policy_headers) # The events API def get_events( self, alert_category: List[str] = None, hash: List[str] = None, device_external_ip: List[str] = None, device_id: List[int] = None, device_internal_ip: List[str] = None, device_name: List[str] = None, device_os: List[str] = None, event_type: List[str] = None, parent_name: List[str] = None, parent_reputation: List[str] = None, process_cmdline: List[str] = None, process_guid: List[str] = None, process_name: List[str] = None, process_pid: List[int] = None, process_reputation: List[str] = None, process_start_time: List[str] = None, process_terminated: List[bool] = None, process_username: List[str] = None, sensor_action: List[str] = None, query: str = None, rows: int = 10, start: int = 0, time_range: str = "{}", ): """Searches for Carbon Black events using the 'api/investigate/v2/orgs/{self.organization_key}/enriched_events/search_jobs' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type alert_category: ``Optional[List[str]]`` :param alert_category: The Carbon Black Cloud classification for events tagged to an alert indicating. Options are: 'threat' or 'observed'. :type hash: ``Optional[List[str]]`` :param hash: Searchable. Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash); enables one-step search for any matches on the specified hashes :type device_external_ip: ``Optional[List[str]]`` :param device_external_ip: The IP address of the endpoint according to the Carbon Black Cloud; can differ from device_internal_ip due to network proxy or NAT; either IPv4 (dotted decimal notation) or IPv6 (proprietary format documented below). :type device_id: ``Optional[List[int]]`` :param device_id: The ID assigned to the endpoint by Carbon Black Cloud; unique across all Carbon Black Cloud environments. :type device_internal_ip ``Optional[List[str]]`` :param device_internal_ip: The IP address of the endpoint reported by the sensor; either IPv4 (dotted decimal notation) or IPv6 (proprietary format, documented below). :type device_name: ``Optional[List[str]]`` :param device_name: The Hostname of the endpoint recorded by the sensor when last initialized. :type device_os: ``Optional[List[str]]`` :param device_os: The operating system of the endpoint. :type event_type: ``Optional[List[str]]`` :param event_type: The type of enriched event observed. (Requires Endpoint Standard). :type parent_name: ``Optional[List[str]]`` :param parent_name: The Filesystem path of the parent process binary. :type parent_reputation: ``Optional[List[str]]`` :param parent_reputation: The Command line executed by the actor process. Options are: 'ADAPTIVE_WHITE_LIST' or 'ADWARE' or 'COMMON_WHITE_LIST' or 'COMPANY_BLACK_LIST' or 'COMPANY_WHITE_LIST' or 'HEURISTIC' or 'IGNORE' or 'KNOWN_MALWARE' or 'LOCAL_WHITE' or 'NOT_LISTED' or 'PUP' or 'RESOLVING' or 'SUSPECT_MALWARE' or 'TRUSTED_WHITE_LIST' :type process_cmdline ``Optional[List[str]]`` :param process_cmdline: The Command line executed by the actor process. :type process_guid: ``Optional[List[str]]`` :param process_guid: The Unique process identifier for the actor process. :type process_name ``Optional[List[str]]`` :param process_name: The Filesystem path of the actor process binary. :type process_pid: ``Optional[List[int]]`` :param process_pid: The Process identifier assigned by the operating system; can be multi-valued in case of fork() or exec() process operations on Linux and macOS. :type process_reputation: ``Optional[List[str]]`` :param process_reputation: The Reputation of the actor process; applied when event is processed by the Carbon Black Cloud. Options are: 'ADAPTIVE_WHITE_LIST' or 'ADWARE' or 'COMMON_WHITE_LIST' or 'COMPANY_BLACK_LIST' or 'COMPANY_WHITE_LIST' or 'HEURISTIC' or 'IGNORE' or 'KNOWN_MALWARE' or 'LOCAL_WHITE' or 'NOT_LISTED' or 'PUP' or 'RESOLVING' or 'SUSPECT_MALWARE' or 'TRUSTED_WHITE_LIST' :type process_start_time: ``Optional[List[str]]`` :param process_start_time: The Sensor reported timestamp of when the process started; not available for processes running before the sensor starts. :type process_terminated: ``Optional[List[bool]]`` :param process_terminated: “True” indicates the process has terminated; always “false” for enriched events (process termination not recorded). Options are: 'true' or 'false' :type process_username: ``Optional[List[str]]`` :param process_username: The User context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions, Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). :type sensor_action: ``Optional[List[str]]`` :param sensor_action: The action performed by the sensor on the process. Options are: 'TERMINATE' or 'DENY' or 'SUSPEND' :type query: ``Optional[str]`` :param query: The Query in lucene syntax and/or including value searches. query or some of the other must be included. :type rows: ``Optional[int]`` :param rows: The Number of rows to request, can be paginated. default is 10. :type start: ``Optional[int]`` :param start: The first row to use for pagination. default is 0. :type time_range: ``Optional[dict]`` :param time_range: The time window to restrict the search to match using device_timestamp as the reference. Window will take priority over start and end if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp :return: Dict containing a job_id to using it in get_events_results. :rtype: ``Dict[str, str]`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/enriched_events/search_jobs" body = assign_params( criteria=assign_params( # one of the arguments (query or criteria) is required alert_category=argToList(alert_category), hash=argToList(hash), device_external_ip=argToList(device_external_ip), device_id=argToList(device_id), device_internal_ip=argToList(device_internal_ip), device_name=argToList(device_name), device_os=argToList(device_os), event_type=argToList(event_type), parent_name=argToList(parent_name), parent_reputation=argToList(parent_reputation), process_cmdline=argToList(process_cmdline), process_guid=argToList(process_guid), process_name=argToList(process_name), process_pid=argToList(process_pid), process_reputation=argToList(process_reputation), process_start_time=argToList(process_start_time), process_terminated=argToList(process_terminated), process_username=argToList(process_username), sensor_action=argToList(sensor_action), ), query=query, # one of the arguments (query or criteria) is required rows=arg_to_number(rows), start=arg_to_number(start), time_range=json.loads(time_range), ) if not body.get("criteria") and not body.get("query"): return "One of the required arguments is missing" return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body) def get_events_results(self, job_id: str = None, rows: int = 10): """Returns Carbon Black events by job_id using the 'api/investigate/v2/orgs/{org_key}/enriched_events/search_jobs/{job_id}/results' API endpoint :type job_id: ``Optional[str]`` :param job_id: The id of the job. :type rows: ``Optional[int]`` :param rows: The number of results to return. default is 10. :return: dict containing the results data'. :rtype: ``dict`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/enriched_events/search_jobs/{job_id}/results?rows={rows}" return self._http_request(method="GET", url_suffix=suffix_url, headers=self.headers) def get_events_details(self, event_ids: List[str] = None): """Returns Carbon Black events details by ID using the 'api/investigate/v2/orgs/{org_key}/enriched_events/search_jobs/{job_id}/results' API endpoint :type event_ids: ``Optional[List[str]]`` :param event_ids: The id of the event. :return: dict containing a job_id to using it in get_events_details_results. :rtype: ``dict`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/enriched_events/detail_jobs" body = assign_params(event_ids=event_ids) return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body) def get_events_details_results(self, job_id: str = None): """Returns Carbon Black event details by job_id using the 'api/investigate/v2/orgs/{org_key}/enriched_events/search_jobs/{job_id}/results' API endpoint :type job_id: ``Optional[str]`` :param job_id: The id of the job. :return: dict containing the event data'. :rtype: ``dict`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/enriched_events/detail_jobs/{job_id}/results" return self._http_request(method="GET", url_suffix=suffix_url, headers=self.headers) # Processes API def get_processes( self, alert_category: List[str] = None, hash: List[str] = None, device_external_ip: List[str] = None, device_id: List[int] = None, device_internal_ip: List[str] = None, device_name: List[str] = None, device_os: List[str] = None, device_timestamp: List[str] = None, event_type: List[str] = None, parent_name: List[str] = None, parent_reputation: List[str] = None, process_cmdline: List[str] = None, process_guid: List[str] = None, process_name: List[str] = None, process_pid: List[int] = None, process_reputation: List[str] = None, process_start_time: List[str] = None, process_terminated: List[bool] = None, process_username: List[str] = None, sensor_action: List[str] = None, query: str = None, rows: int = 10, start: int = 0, time_range: str = "{}", ): """Searches for Carbon Black events using the 'api/investigate/v2/orgs/{self.organization_key}/enriched_events/search_jobs' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type alert_category: ``Optional[List[str]]`` :param alert_category: The Carbon Black Cloud classification for events tagged to an alert indicating. Options are: 'threat' or 'observed'. :type hash: ``Optional[List[str]]`` :param hash: Searchable. Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash); enables one-step search for any matches on the specified hashes :type device_external_ip: ``Optional[List[str]]`` :param device_external_ip: The IP address of the endpoint according to the Carbon Black Cloud; can differ from device_internal_ip due to network proxy or NAT; either IPv4 (dotted decimal notation) or IPv6 (proprietary format documented below). :type device_id: ``Optional[List[int]]`` :param device_id: The ID assigned to the endpoint by Carbon Black Cloud; unique across all Carbon Black Cloud environments. :type device_internal_ip ``Optional[List[str]]`` :param device_internal_ip: The IP address of the endpoint reported by the sensor; either IPv4 (dotted decimal notation) or IPv6 (proprietary format, documented below). :type device_name: ``Optional[List[str]]`` :param device_name: The Hostname of the endpoint recorded by the sensor when last initialized. :type device_os: ``Optional[List[str]]`` :param device_os: The operating system of the endpoint. :type device_timestamp: ``Optional[List[str]]`` :param device_timestamp: The Sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. :type event_type: ``Optional[List[str]]`` :param event_type: The type of enriched event observed. (Requires Endpoint Standard). :type parent_name: ``Optional[List[str]]`` :param parent_name: The Filesystem path of the parent process binary. :type parent_reputation: ``Optional[List[str]]`` :param parent_reputation: The Command line executed by the actor process. Options are: 'ADAPTIVE_WHITE_LIST' or 'ADWARE' or 'COMMON_WHITE_LIST' or 'COMPANY_BLACK_LIST' or 'COMPANY_WHITE_LIST' or 'HEURISTIC' or 'IGNORE' or 'KNOWN_MALWARE' or 'LOCAL_WHITE' or 'NOT_LISTED' or 'PUP' or 'RESOLVING' or 'SUSPECT_MALWARE' or 'TRUSTED_WHITE_LIST' :type process_cmdline ``Optional[List[str]]`` :param process_cmdline: The Command line executed by the actor process. :type process_guid: ``Optional[List[str]]`` :param process_guid: The Unique process identifier for the actor process. :type process_name ``Optional[List[str]]`` :param process_name: The Filesystem path of the actor process binary. :type process_pid: ``Optional[List[int]]`` :param process_pid: The Process identifier assigned by the operating system; can be multi-valued in case of fork() or exec() process operations on Linux and macOS. :type process_reputation: ``Optional[List[str]]`` :param process_reputation: The Reputation of the actor process; applied when event is processed by the Carbon Black Cloud. Options are: 'ADAPTIVE_WHITE_LIST' or 'ADWARE' or 'COMMON_WHITE_LIST' or 'COMPANY_BLACK_LIST' or 'COMPANY_WHITE_LIST' or 'HEURISTIC' or 'IGNORE' or 'KNOWN_MALWARE' or 'LOCAL_WHITE' or 'NOT_LISTED' or 'PUP' or 'RESOLVING' or 'SUSPECT_MALWARE' or 'TRUSTED_WHITE_LIST' :type process_start_time: ``Optional[List[str]]`` :param process_start_time: The Sensor reported timestamp of when the process started; not available for processes running before the sensor starts. :type process_terminated: ``Optional[List[bool]]`` :param process_terminated: “True” indicates the process has terminated; always “false” for enriched events (process termination not recorded). Options are: 'true' or 'false' :type process_username: ``Optional[List[str]]`` :param process_username: The User context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions, Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). :type sensor_action: ``Optional[List[str]]`` :param sensor_action: The action performed by the sensor on the process. Options are: 'TERMINATE' or 'DENY' or 'SUSPEND' :type query: ``Optional[str]`` :param query: The Query in lucene syntax and/or including value searches. query or some of the other must be included. :type rows: ``Optional[int]`` :param rows: The Number of rows to request, can be paginated. default is 10. :type start: ``Optional[int]`` :param start: The first row to use for pagination. default is 0. :type time_range: ``Optional[dict]`` :param time_range: The time window to restrict the search to match using device_timestamp as the reference. Window will take priority over start and end if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp :return: Dict containing a job_id to using it in get_process_results. :rtype: ``Dict[str, str]`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/processes/search_jobs" body = assign_params( criteria=assign_params( # one of the arguments (query or criteria) is required alert_category=argToList(alert_category), hash=argToList(hash), device_external_ip=argToList(device_external_ip), device_id=argToList(device_id), device_internal_ip=argToList(device_internal_ip), device_name=argToList(device_name), device_os=argToList(device_os), device_timestamp=argToList(device_timestamp), event_type=argToList(event_type), parent_name=argToList(parent_name), parent_reputation=argToList(parent_reputation), process_cmdline=argToList(process_cmdline), process_guid=argToList(process_guid), process_name=argToList(process_name), process_pid=argToList(process_pid), process_reputation=argToList(process_reputation), process_start_time=argToList(process_start_time), process_terminated=argToList(process_terminated), process_username=argToList(process_username), sensor_action=argToList(sensor_action), ), query=query, # one of the arguments (query or criteria) is required rows=arg_to_number(rows), start=arg_to_number(start), time_range=json.loads(time_range), ) if not body.get("criteria") and not body.get("query"): return "One of the required arguments is missing" return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body) def get_process_results(self, job_id: str = None, rows: int = 10): """Returns Carbon Black events by job_id using the 'api/investigate/v2/orgs/{org_key}/processes/search_jobs/{job_id}/results' API endpoint :type job_id: ``Optional[str]`` :param job_id: The id of the job. :type rows: ``Optional[int]`` :param rows: The number of results to return. default is 10. :return: dict containing the results data'. :rtype: ``dict`` """ suffix_url = f"api/investigate/v2/orgs/{self.organization_key}/processes/search_jobs/{job_id}/results?rows={rows}" return self._http_request(method="GET", url_suffix=suffix_url, headers=self.headers) # Alerts API def get_alerts( self, alert_type: str = None, category: List[str] = None, device_id: List[int] = None, first_event_time: dict = None, policy_id: List[int] = None, process_sha256: List[str] = None, reputation: List[str] = None, tag: List[str] = None, device_username: List[str] = None, query: str = None, rows: int = None, start: int = None, ): """Searches for Carbon Black alerts using the '/appservices/v6/orgs/{org_key}/alerts/_search' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type alert_type: ``Optional[str]`` :param alert_type: type of the alert to search for. Options are: 'all' or 'cbanalytics' or 'devicecontrol' :type category: ``Optional[list]`` :param category: The category of the alert. Options are: 'THREAT' or 'MONITORED' :type device_id: ``Optional[list]`` :param device_id: The identifier assigned by Carbon Black Cloud to the device associated with the alert. :type first_event_time: ``Optional[dict]`` :param first_event_time: The time of the first event associated with the alert. The syntax is {"start": "<dateTime>", "range": "<string>", "end": "<dateTime>" }. For example: {"start": "2010-09-25T00:10:50.00", "end": "2015-01-20T10:40:00.00Z", "range": "-1d"}. (s for seconds, m for minutes, h for hours, d for days, w for weeks, y for years). :type policy_id: ``Optional[list]`` :param policy_id: The identifier for the policy associated with the device at the time of the alert. :type process_sha256: ``Optional[list]`` :param process_sha256: The SHA256 Hash of the primary involved process. :type device_username: ``Optional[list]`` :param device_username: The username of the logged on user during the alert. If the user is not available then it may be populated with the device owner :type reputation: ``Optional[str]`` :param reputation: Reputation of the primary involved process (KNOWN_MALWARE, NOT_LISTED, etc.). :type tag: ``Optional[str]`` :param tag: The tags associated with the alert. :type query: ``Optional[str]`` :param query: Query in lucene syntax and/or including value searches. :type rows: ``Optional[int]`` :param rows: The number of results to return. default is 50. :type start: ``Optional[int]`` :param start: The number of the alert where to start retrieving results from. :return: Dict containing a Carbon Black alert. :rtype: ``Dict[str, Any]`` """ if not alert_type or alert_type == "all": suffix_url = f"appservices/v6/orgs/{self.organization_key}/alerts/_search" else: suffix_url = f"appservices/v6/orgs/{self.organization_key}/alerts/{alert_type.lower()}/_search" body = assign_params( criteria=assign_params( category=category, device_id=device_id, first_event_time=first_event_time, policy_id=policy_id, process_sha256=process_sha256, reputation=reputation, tag=tag, device_username=device_username, ), query=query, rows=rows, start=start, ) return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body) def get_alert_by_id(self, alert_id: str = None) -> dict: """Searches for Carbon Black alert by ID using the 'appservices/v6/orgs/{org_key}/alerts/{alert_id}' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type alert_id: ``Optional[str]`` :param alert_id: The id of the alert :return: Dict containing a Carbon Black alert. :rtype: ``Dict[str, Any]`` """ res = self._http_request( method="GET", url_suffix=f"appservices/v6/orgs/{self.organization_key}/alerts/{alert_id}", headers=self.headers ) return res # Devices API def get_devices( self, device_id: List = None, status: List = None, device_os: List = None, last_contact_time: dict[str, Optional[Any]] = None, target_priority: List = None, query: str = None, rows: int = None, ) -> dict: """Searches for Carbon Black devices using the 'appservices/v6/orgs/{org_key}/devices/_search' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type device_id: ``Optional[List[str]]`` :param device_id: The id of the device :type status: ``Optional[List[str]]`` :param status: The status of the device. Options are: 'PENDING' or 'REGISTERED' or 'DEREGISTERED' or 'BYPASS ,ACTIVE' or 'INACTIVE' or 'ERROR' or 'ALL' or 'BYPASS_ON' or 'LIVE' or 'SENSOR_PENDING_UPDATE' :type device_os: ``Optional[List[str]]`` :param device_os: The Operating System. Options are: 'WINDOWS' or 'MAC' or 'LINUX' or 'OTHER'. :type last_contact_time: ``Optional[dict]`` :param last_contact_time: :type target_priority: ``Optional[List[str]]`` :param target_priority: The id of the device :type query: ``Optional[str]`` :param query: Query in lucene syntax. :type rows: ``Optional[int]`` :param rows: The number of results to return. default is 20. :return: Dict containing a List with the found Carbon Black devices as dicts :rtype: ``Dict[str, Any]`` """ suffix_url = f"/appservices/v6/orgs/{self.organization_key}/devices/_search" body = assign_params( criteria=assign_params( id=device_id, status=status, os=device_os, last_contact_time=last_contact_time, target_priority=target_priority ), query=query, rows=arg_to_number(rows), ) return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body) def execute_an_action_on_the_device(self, device_id: List[int] = None, action_type: str = None, options: dict = None) -> str: """execute actions on devices using the 'appservices/v6/orgs/{org_key}/device_actions' API endpoint All the parameters are passed directly to the API as HTTP POST parameters in the request :type device_id: ``Optional[List[int]]`` :param device_id: The id of the device :type action_type: ``Optional[str]`` :param action_type: Action to perform on selected devices. :type options: ``Optional[dict]`` :param options: A dict {"toggle": "ON/OFF"} """ suffix_url = f"appservices/v6/orgs/{self.organization_key}/device_actions" body = assign_params(action_type=action_type, device_id=device_id, options=options) return self._http_request(method="POST", url_suffix=suffix_url, headers=self.headers, json_data=body, resp_type="text") def fetch_incident_filters(params: dict): filters = { "suffix_url_path": params.get("suffix_url_path", "all"), "min_severity": params.get("min_severity"), "category": argToList(params.get("category")), "device_id": argToList(params.get("device_id")), "policy_id": argToList(params.get("policy_id")), "device_username": argToList(params.get("device_username")), "query": params.get("query"), } if filters.get("query"): filters_without_query = dict(filters) del filters_without_query["suffix_url_path"] del filters_without_query["query"] if not any(filters_without_query.values()): return filters raise DemistoException("The 'query' parameter should be used without additional parameters to fetch incidents.") else: return filters def test_module(client: Client, params: dict) -> str: """Tests API connectivity and authentication' Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. Raises exceptions if something goes wrong. :type client: ``Client`` :param client: client to use :type params: ``Dict`` :param params: parameters that initialized by creating the instance :return: 'ok' if test passed, anything else will fail the test. :rtype: ``str`` """ """There is 2 sets of api_key&api_secret_key 1 for all API's and 1 for the policy API. check which set of keys to test (organization_key is not needed for the policy pair of keys). at least one of the 2 sets is required. Fetch uses the general api_key.""" is_fetch = params.get("isFetch") # if is_fetch = true and custom API key's is no provided if is_fetch and not (client.api_key and client.api_secret_key and client.organization_key): return ( "To fetch incidents you must fill the following parameters: " "Custom API key, Custom API secret key and Organization key" ) message = ( "Missing parameters Error: At least one complete set of API keys " "(Custom API keys or Api/Live-Response API keys) is required" ) # if all of the custom API key's is provided if client.api_key and client.api_secret_key and client.organization_key: try: client.test_module_request() # if is_fetch = true, try to fetch if is_fetch: filters = fetch_incident_filters(params) client.search_alerts_request( suffix_url_path=filters.get("suffix_url_path"), minimum_severity=filters.get("min_severity"), policy_id=filters.get("policy_id"), device_username=filters.get("device_username"), device_id=filters.get("device_id"), query=filters.get("query"), alert_category=filters.get("category"), ) message = "ok" except Exception as e: if "authenticated" in str(e) or "Forbidden" in str(e): return "Authorization Error: make sure Custom API Key is correctly set" else: raise e # if one or more of the custom API keys are provided elif client.api_key or client.api_secret_key or client.organization_key: return ( "Missing custom API parameters. Please fill all the relevant parameters: " "Custom API key, Custom API secret key and Organization key." ) # if all of the api/live-response API key's is provided if client.policy_api_key and client.policy_api_secret_key: try: client.policy_test_module_request() message = "ok" except Exception as e: if "Authentication" in str(e) or "authenticated" in str(e): return "Authorization Error: make sure API Key is correctly set" else: raise e # if only one of the api/live-response API keys are provided elif client.policy_api_key or client.policy_api_secret_key: return "Missing API parameters. Please fill all the relevant parameters: API key, API secret key" return message def convert_to_demisto_severity(severity: int) -> int: """Maps Carbon Black severity to Cortex XSOAR severity Converts the Carbon Black alert severity level (1 to 10) to Cortex XSOAR incident severity (1 to 4) for mapping. :type severity: ``int`` :param severity: severity as returned from the Carbon Black API (int: 1 to 10) :return: Cortex XSOAR Severity (int: 1 to 4) :rtype: ``int`` """ return { 1: IncidentSeverity.LOW, 2: IncidentSeverity.LOW, 3: IncidentSeverity.LOW, 4: IncidentSeverity.MEDIUM, 5: IncidentSeverity.MEDIUM, 6: IncidentSeverity.MEDIUM, 7: IncidentSeverity.HIGH, 8: IncidentSeverity.HIGH, 9: IncidentSeverity.CRITICAL, 10: IncidentSeverity.CRITICAL, }[severity] def fetch_incidents( client: Client, fetch_time: str, fetch_limit: int, last_run: dict, filters: dict ) -> tuple[List[dict], dict[str, int]]: """This function retrieves new alerts every interval (default is 1 minute). This function has to implement the logic of making sure that incidents are fetched only once and no incidents are missed. By default it's invoked by XSOAR every minute. It will use last_run to save the timestamp of the last incident it processed. If last_run is not provided, it should use the integration parameter first_fetch to determine when to start fetching the first time. :type client: ``Client`` :param client: client to use :type fetch_time: ``Optional[str]`` :param fetch_time: If last_run is None (first time we are fetching), it contains the timestamp in milliseconds on when to start fetching incidents :type fetch_limit: ``int`` :param fetch_limit: Maximum incidents per fetch. :type last_run: ``Optional[Dict[str, int]]`` :param last_run: A dict with a key containing the latest incident created time we got from last fetch. :type filters: ``Optional[dict]`` :param filters: Some filters to filter alerts by device_id or query etc.. :return: A tuple containing two elements: next_run (``Dict[str, int]``): Contains the timestamp that will be used in ``last_run`` on the next fetch. incidents (``List[dict]``): List of incidents that will be created in XSOAR :rtype: ``Tuple[List[dict], Dict[str, int]]`` """ last_fetched_alert_create_time = last_run.get("last_fetched_alert_create_time") last_fetched_alert_id = last_run.get("last_fetched_alert_id", "") if not last_fetched_alert_create_time: last_fetched_alert_create_time, _ = parse_date_range(fetch_time, date_format="%Y-%m-%dT%H:%M:%S.000Z") else: fetch_limit += 1 # We skip the first alert alert_create_date = last_fetched_alert_create_time alert_id = last_fetched_alert_id incidents = [] response = client.search_alerts_request( suffix_url_path=filters.get("suffix_url_path"), minimum_severity=filters.get("min_severity"), alert_category=filters.get("category"), device_id=filters.get("device_id"), policy_id=filters.get("policy_id"), device_username=filters.get("device_username"), query=filters.get("query"), sort_field="create_time", sort_order="ASC", create_time=assign_params(start=last_fetched_alert_create_time, end=datetime.now().strftime("%Y-%m-%dT%H:%M:%S.000Z")), limit=fetch_limit, ) alerts = response.get("results", []) for alert in alerts: if alert_id == alert.get("id"): continue alert_create_date = alert.get("create_time") alert_id = alert.get("id") incident = { "type": "Carbon Black Endpoint Standard", "name": f"Carbon Black Defense alert {alert_id}", "occurred": alert_create_date, "rawJSON": json.dumps(alert), "severity": convert_to_demisto_severity(alert.get("severity", 1)), } incidents.append(incident) res = {"last_fetched_alert_create_time": alert_create_date, "last_fetched_alert_id": alert_id} return incidents, res def create_policy_command(client: Client, args: dict): name = args.get("name") description = args.get("description") priority_level = args.get("priorityLevel") policy = args.get("policy") if not policy: return "The policy argument is required." res = client.create_new_policy(name, description, priority_level, json.loads(policy)) if res.get("message") == "Success": return get_policy_command(client, {"policyId": res.get("policyId")}) return CommandResults(readable_output=res, raw_response=res) def get_policies_command(client: Client, args: dict): res = client.get_policies() human_readable = [] policies = res.get("results", []) headers = ["id", "priorityLevel", "systemPolicy", "latestRevision", "version"] if not policies: return "No policy found." for policy in policies: human_readable.append( { "id": policy.get("id"), "priorityLevel": policy.get("priorityLevel"), "systemPolicy": policy.get("systemPolicy"), "latestRevision": timestamp_to_datestring(policy.get("latestRevision")), "version": policy.get("version"), } ) readable_output = tableToMarkdown( "Carbon Black Defense Policies", human_readable, headers=headers, headerTransform=pascalToSpace, removeNull=True ) return CommandResults( outputs_prefix="CarbonBlackDefense.Policy", outputs_key_field="id", outputs=policies, readable_output=readable_output, raw_response=res, ) def get_policy_command(client: Client, args: dict): policy_id = args.get("policyId") headers = ["id", "description", "name", "latestRevision", "version", "priorityLevel", "systemPolicy"] res = client.get_policy_by_id(policy_id) policy_info = dict(res.get("policyInfo")) if not policy_info: return "Policy not found, You may not have sent a correct policy id." del policy_info["policy"] # we delete the policy info (it's too big) from the human readable policy_info["latestRevision"] = timestamp_to_datestring(policy_info.get("latestRevision", "")) readable_output = tableToMarkdown( "Carbon Black Defense Policy", policy_info, headers=headers, headerTransform=pascalToSpace, removeNull=True ) return CommandResults( outputs_prefix="CarbonBlackDefense.Policy", outputs_key_field="id", outputs=res.get("policyInfo"), readable_output=readable_output, raw_response=res, ) def set_policy_command(client: Client, args: dict): policy_id = args.get("policy") policy_info = args.get("keyValue") if not policy_info: return "The policy_info argument is required." res = client.set_policy(policy_id, json.loads(policy_info)) if res.get("message") == "Success": return get_policy_command(client, {"policyId": policy_id}) return CommandResults(readable_output=res, raw_response=res) def update_policy_command(client: Client, args: dict): policy_id = args.get("id") name = args.get("name") description = args.get("description") priority_level = args.get("priorityLevel") policy = args.get("policy") if not policy: return "The policy argument is required." res = client.update_policy(policy_id, name, description, priority_level, json.loads(policy)) if res.get("message") == "Success": return get_policy_command(client, {"policyId": policy_id}) return CommandResults(readable_output=res, raw_response=res) def delete_policy_command(client: Client, args: dict): policy_id = args.get("policyId") res = client.delete_policy(policy_id) return CommandResults( readable_output=tableToMarkdown( f"The policy {policy_id} was deleted successfully", res, headerTransform=string_to_table_header ), raw_response=res, ) def add_rule_to_policy_command(client: Client, args: dict): policy_id = args.get("policyId") action = args.get("action") operation = args.get("operation") required = args.get("required") type = args.get("type") value = args.get("value") res = client.add_rule_to_policy(policy_id, action, operation, required, type, value) if res.get("message") == "Success": return get_policy_command(client, {"policyId": policy_id}) return CommandResults(readable_output=res, raw_response=res) def update_rule_in_policy_command(client: Client, args: dict): policy_id = args.get("policyId") action = args.get("action") operation = args.get("operation") required = args.get("required") rule_id = args.get("id") type = args.get("type") value = args.get("value") res = client.update_rule_in_policy(policy_id, action, operation, required, rule_id, type, value) if res.get("message") == "Success": return get_policy_command(client, {"policyId": policy_id}) return CommandResults(readable_output=res, raw_response=res) def delete_rule_from_policy_command(client: Client, args: dict): policy_id = arg_to_number(args.get("policyId")) rule_id = arg_to_number(args.get("ruleId")) res = client.delete_rule_from_policy(policy_id, rule_id) readable_output = tableToMarkdown( "The rule was successfully deleted from the policy", res, headerTransform=string_to_table_header ) return CommandResults(readable_output=readable_output, raw_response=res) def find_events_command(client: Client, args: dict): res = client.get_events(**assign_params(**args)) # In case the request failed (for example if the query & all other required arguments is empty) if "job_id" not in res: return res readable_output = tableToMarkdown("Carbon Black Defense Events Search", res, headerTransform=string_to_table_header) return CommandResults( outputs_prefix="CarbonBlackDefense.Events.Search", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def find_events_results_command(client: Client, args: dict): job_id = args.get("job_id") rows = args.get("rows", 10) res = client.get_events_results(job_id, rows) headers = [ "event_id", "device_id", "event_network_remote_port", "event_network_remote_ipv4", "event_network_local_ipv4", "enriched_event_type", ] res["job_id"] = job_id human_readable = res.get("results", {}) readable_output = tableToMarkdown( "Carbon Black Defense Event Results", human_readable, headers=headers, headerTransform=string_to_table_header, removeNull=True, ) return CommandResults( outputs_prefix="CarbonBlackDefense.Events.Results", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def find_events_details_command(client: Client, args: dict): event_ids = argToList(args.get("event_ids")) res = client.get_events_details(event_ids) readable_output = tableToMarkdown("Carbon Black Defense Event Details Search", res, headerTransform=string_to_table_header) return CommandResults( outputs_prefix="CarbonBlackDefense.EventDetails.Search", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def find_events_details_results_command(client: Client, args: dict): job_id = args.get("job_id") res = client.get_events_details_results(job_id) headers = [ "event_id", "device_id", "event_network_remote_port", "event_network_remote_ipv4", "event_network_local_ipv4", "enriched_event_type", ] res["job_id"] = job_id human_readable = res.get("results") readable_output = tableToMarkdown( "Carbon Black Defense Event Details Results", human_readable, headers=headers, headerTransform=string_to_table_header, removeNull=True, ) return CommandResults( outputs_prefix="CarbonBlackDefense.EventDetails.Results", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def find_processes_command(client: Client, args: dict): res = client.get_processes(**assign_params(**args)) # In case the request failed (for example if the query & all other required arguments is empty) if "job_id" not in res: return res readable_output = tableToMarkdown("Carbon Black Defense Processes Search", res, headerTransform=string_to_table_header) return CommandResults( outputs_prefix="CarbonBlackDefense.Process.Search", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def find_processes_results_command(client: Client, args: dict): job_id = args.get("job_id") rows = args.get("rows") if not rows: rows = 10 res = client.get_process_results(job_id, rows) headers = ["device_id", "device_name", "process_name", "device_policy_id", "enriched_event_type"] res["job_id"] = job_id human_readable = res.get("results") readable_output = tableToMarkdown( "The Results For The Process Search", human_readable, headers=headers, removeNull=True, headerTransform=string_to_table_header, ) return CommandResults( outputs_prefix="CarbonBlackDefense.Process.Results", outputs_key_field="job_id", outputs=res, readable_output=readable_output, raw_response=res, ) def alerts_search_command(client: Client, args: dict): alert_type = args.get("type", "all") category = argToList(args.get("category")) device_id = argToList(args.get("device_id")) first_event_time = args.get("first_event_time") policy_id = argToList(args.get("policy_id")) process_sha256 = argToList(args.get("process_sha256")) reputation = argToList(args.get("reputation")) tag = argToList(args.get("tag")) device_username = argToList(args.get("device_username")) query = args.get("query") rows = args.get("rows") start = args.get("start") headers = [ "id", "category", "device_id", "device_name", "device_username", "create_time", "ioc_hit", "policy_name", "process_name", "type", "severity", ] if first_event_time: first_event_time = json.loads(first_event_time) res = client.get_alerts( alert_type, category, device_id, first_event_time, policy_id, process_sha256, reputation, tag, device_username, query, rows, start, ) alerts = res.get("results", []) if not alerts: return "No alerts were found." readable_output = tableToMarkdown( "Carbon Black Defense Alerts List Results", alerts, headers, headerTransform=string_to_table_header, removeNull=True ) return CommandResults( outputs_prefix="CarbonBlackDefense.Alert", outputs_key_field="id", outputs=alerts, readable_output=readable_output, raw_response=res, ) def get_alert_details_command(client: Client, args: dict): alert_id = args.get("alertId") res = client.get_alert_by_id(alert_id) if "id" not in res: return f"The alert id: {alert_id} was not found" headers = [ "id", "category", "device_id", "device_name", "device_username", "create_time", "ioc_hit", "policy_name", "process_name", "type", "severity", ] readable_output = tableToMarkdown( "Carbon Black Defense Get Alert Details", res, headers, headerTransform=string_to_table_header, removeNull=True ) return CommandResults( outputs_prefix="CarbonBlackDefense.Alert", outputs_key_field="id", outputs=res, readable_output=readable_output, raw_response=res, ) def device_search_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) device_os = argToList(args.get("os")) device_status = argToList(args.get("status")) start_time, end_time = args.get("start_time"), args.get("end_time") if start_time and end_time: last_location = {"start": start_time, "end": end_time} elif (not start_time and end_time) or (start_time and not end_time): raise ValueError("both start_time and end_time must be set") else: last_location = None target_priority = argToList(args.get("target_priority")) query = args.get("query") rows = args.get("rows") headers = [ "id", "name", "os", "policy_name", "quarantined", "status", "target_priority", "last_internal_ip_address", "last_external_ip_address", "last_contact_time", "last_location", ] result = client.get_devices(device_id, device_status, device_os, last_location, target_priority, query, rows) devices = result.get("results", []) if not devices: return "No devices were found." readable_output = tableToMarkdown( "Carbon Black Defense Devices List Results", devices, headers, headerTransform=string_to_table_header, removeNull=True ) return CommandResults( outputs_prefix="CarbonBlackDefense.Device", outputs_key_field="id", outputs=devices, readable_output=readable_output, raw_response=result, ) def device_quarantine_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "QUARANTINE", {"toggle": "ON"}) return CommandResults( readable_output="Device quarantine successfully", ) def device_unquarantine_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "QUARANTINE", {"toggle": "OFF"}) return CommandResults( readable_output="Device unquarantine successfully", ) def device_background_scan_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "BACKGROUND_SCAN", {"toggle": "ON"}) return CommandResults( readable_output="Background scan started successfully", ) def device_background_scan_stop_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "BACKGROUND_SCAN", {"toggle": "OFF"}) return CommandResults( readable_output="Background scan stopped successfully", ) def device_bypass_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "BYPASS", {"toggle": "ON"}) return CommandResults( readable_output="Device bypass successfully", ) def device_unbypass_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) client.execute_an_action_on_the_device(device_id, "BYPASS", {"toggle": "OFF"}) return CommandResults( readable_output="Device unbypass successfully", ) def device_policy_update_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) policy_id = args.get("policy_id") client.execute_an_action_on_the_device(device_id, "UPDATE_POLICY", {"policy_id": policy_id}) return CommandResults( readable_output="Policy updated successfully", ) def device_update_sensor_version_command(client: Client, args: dict): device_id = argToList(args.get("device_id")) sensor_version = args.get("sensor_version") if not sensor_version: return "The sensor_version argument is required." client.execute_an_action_on_the_device(device_id, "UPDATE_SENSOR_VERSION", {"sensor_version": json.loads(sensor_version)}) return CommandResults( readable_output=f"Version update to {sensor_version} was successful", ) """ MAIN FUNCTION """ def main() -> None: command = demisto.command() # Get the parameters params = demisto.params() base_url = params.get("url") api_key = params.get("custom_credentials").get("identifier") api_secret_key = params.get("custom_credentials").get("password") policy_api_key = params.get("live_response_credentials").get("identifier") policy_api_secret_key = params.get("live_response_credentials").get("password") organization_key = params.get("organization_key") verify_certificate = not params.get("insecure", False) demisto.info(f"Command being called is {command}") try: client = Client( base_url=base_url, verify=verify_certificate, proxies=handle_proxy(), api_key=api_key, api_secret_key=api_secret_key, policy_api_key=policy_api_key, policy_api_secret_key=policy_api_secret_key, organization_key=organization_key, ) commands = { "cbd-create-policy": create_policy_command, "cbd-get-policies": get_policies_command, "cbd-get-policy": get_policy_command, "cbd-set-policy": set_policy_command, "cbd-update-policy": update_policy_command, "cbd-delete-policy": delete_policy_command, "cbd-add-rule-to-policy": add_rule_to_policy_command, "cbd-update-rule-in-policy": update_rule_in_policy_command, "cbd-delete-rule-from-policy": delete_rule_from_policy_command, "cbd-find-events": find_events_command, "cbd-find-events-results": find_events_results_command, "cbd-find-events-details": find_events_details_command, "cbd-find-events-details-results": find_events_details_results_command, "cbd-find-processes": find_processes_command, "cbd-find-processes-results": find_processes_results_command, "cbd-alerts-search": alerts_search_command, "cbd-get-alert-details": get_alert_details_command, "cbd-device-search": device_search_command, "cbd-device-quarantine": device_quarantine_command, "cbd-device-unquarantine": device_unquarantine_command, "cbd-device-background-scan": device_background_scan_command, "cbd-device-background-scan-stop": device_background_scan_stop_command, "cbd-device-bypass": device_bypass_command, "cbd-device-unbypass": device_unbypass_command, "cbd-device-policy-update": device_policy_update_command, "cbd-device-update-sensor-version": device_update_sensor_version_command, } if command == "test-module": return_results(test_module(client, params)) elif command == "fetch-incidents": fetch_time = params.get("first_fetch", "7 days") fetch_limit = int(params.get("max_fetch", 50)) filters = fetch_incident_filters(params) # Set and define the fetch incidents command to run after activated via integration settings. incidents, last_run = fetch_incidents(client, fetch_time, fetch_limit, last_run=demisto.getLastRun(), filters=filters) demisto.incidents(incidents) demisto.setLastRun(last_run) elif command in commands: command_results = commands[command](client, demisto.args()) return_results(command_results) else: raise NotImplementedError(f"{COMMAND_NOT_IMPELEMENTED_MSG}: {command}") # Log exceptions and return error except Exception as e: return_error(f"Failed to execute {command} command.\nError:\n{e!s}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()