CarbonBlackEndpointStandardEventCollector

Details

ID	`CarbonBlackEndpointStandardEventCollector`
Provider	Broadcom
Category	Endpoint
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Carbon Black Endpoint Standard Event Collector in Cortex

Parameter	Description	Required
Server URL		True
API ID	The API Key to use for connection	True
API Secret Key		True
Organization Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Include Audit Logs		False
Maximum number of alerts per fetch	Default 100,000.	False
Maximum number of audit logs per fetch	Default 25,000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

carbonblack-endpoint-standard-get-events

Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Base Command

carbonblack-endpoint-standard-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display the events. Possible values are: true, false. Default is false.	Required
alerts_limit	The maximum number of alerts to return (maximum value - 100000). Default is 10000.	Optional
audit_logs_limit	The maximum number of audit logs to return (maximum value - 25000). Default is 2500.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — API ID (required)
org_key — Organization Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
add_audit_logs — Include Audit Logs
max_alerts — Maximum number of alerts per fetch
max_audit_logs — Maximum number of audit logs per fetch

Commands (1)

carbonblack-endpoint-standard-get-events
Fetch alerts and audit logs from Carbon Black Endpoint Standard.

Source

CarbonBlackEndpointStandardEventCollector.py CarbonBlackEndpointStandardEventCollector_test.py CarbonBlackEndpointStandardEventCollector.yml CarbonBlackEndpointStandardEventCollector_description.md command_examples.txt

Download History Raw

category: Endpoint
provider: Broadcom
sectionorder:
- Connect
- Collect
commonfields:
  id: CarbonBlackEndpointStandardEventCollector
  version: -1
configuration:
- display: Server URL
  defaultvalue: 'https://defense.conferdeploy.net'
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Secret Key
  display: API ID
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Organization Key
  name: org_key
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Include Audit Logs
  name: add_audit_logs
  type: 8
  required: false
  section: Collect
- display: Maximum number of alerts per fetch
  additionalinfo: Default 100,000.
  defaultvalue: '100000'
  name: max_alerts
  type: 0
  required: false
  section: Collect
- display: Maximum number of audit logs per fetch
  additionalinfo: Default 25000.
  defaultvalue: '25000'
  name: max_audit_logs
  type: 0
  required: false
  section: Collect
description: 'Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.'
display: Carbon Black Endpoint Standard Event Collector
name: CarbonBlackEndpointStandardEventCollector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display the events.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The maximum number of alerts to return (maximum value - 100000).
      name: alerts_limit
      defaultValue: 10000
    - description: The maximum number of audit logs to return (maximum value - 25000).
      name: audit_logs_limit
      defaultValue: 2500
    description: 'Fetch alerts and audit logs from Carbon Black Endpoint Standard.'
    name: carbonblack-endpoint-standard-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
  isfetchevents: true
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
supportedModules:
- xsiam