Carbon Black Endpoint Standard v3
Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.
Endpoint · Carbon Black Endpoint Standard
Details
| ID | Carbon Black Endpoint Standard v3 |
|---|---|
| Provider | Broadcom |
| Category | Endpoint |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.
This integration was integrated and tested with version 1.1.2 of Carbon Black Endpoint Standard v3.
Migration to Carbon Black Endpoint Standard v3
Deprecated Commands in Carbon Black Endpoint Standard v2
The following commands from the Carbon Black Endpoint Standard v2 integration have been deprecated and replaced with v3 commands:
| Deprecated Command | New v3 Command | Comments |
|---|---|---|
cbd-find-events |
cbd-find-observation |
Includes cbd-find-events-results. |
cbd-find-events-results |
cbd-find-observation-results |
Manually check results without polling. |
cbd-find-events-details |
cbd-find-observation-details |
Includes cbd-find-events-details-results. |
cbd-find-events-details-results |
cbd-find-observation-details-results |
Manually check details results without polling. |
cbd-find-processes-results |
cbd-find-processes cbd-find-processes-results |
Retrieve results via polling or manually with cbd-find-processes-results. |
cbd-get-policies |
cbd-get-policies-summary |
Important Changes in Carbon Black Endpoint Standard v3
- Organization Key: Updated to be a required field.
- cbd-find-processes: Enhanced to include process results when polling=true.
- cbd-find-observation-results: Added to manually retrieve observation results without polling.
- cbd-find-observation-details-results: Added to manually retrieve observation details results without polling.
- cbd-alerts-search: Updated context output; deprecated category arg and updated tag arg to tags.
- policy commands: Context output updated ; policy arg format changed.
- rules commands: Updated context output and operation arg options.
Deprecated Playbooks
- Carbon Black Endpoint Standard Find Event Details: Use cbd-find-observation-details command instead.
- Carbon Black Endpoint Standard Find Events: Use cbd-find-observation command instead.
- Carbon Black Endpoint Standard Find Processes: Use cbd-find-processes command instead.
Mapper
Carbon Black Endpoint Standard Mapper.
Layout
Carbon Black Endpoint Standard Incoming Layout.
Classifier
Carbon Black Endpoint Standard
Configure Carbon Black Endpoint Standard v3 in Cortex
| Parameter | Description | Required |
|---|---|---|
| URL | True | |
| Organization Key | The organization unique key. This is required for all use cases (and for fetching incidents). | True |
| Custom Api Key | This Custom API key is required for all use cases and for fetch except the policy use cases. | False |
| Password | This Custom API key is required for all use cases and for fetch except the policy use cases. | False |
| Api Key (Api/Live Response key) | This Live Response API key is required only for the policy use cases. | False |
| Password | This Live Response API key is required only for the policy use cases. | False |
| Incident type | False | |
| Fetch incidents | False | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| The type of the alert | Type of alert to be fetched. | False |
| Device ID | The alerts related to a specific device, according to the device ID. | False |
| Policy ID | The alerts related to a specific policy, according to the policy ID. | False |
| Device username | The alerts related to a specific device, according to the device username. | False |
| Minimum severity | The minimum severity of the alerts to be fetched. | False |
| Query | Query in Lucene syntax and/or value searches. If defined, the other fetch incidents parameters should be left blank. | False |
| First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). | False | |
| Maximum number of incidents per fetch | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cbd-get-alert-details
Gets alert details according to alert ID, including alert metadata and a list of all events associated with the alert. Only API keys of type “API” can call the alert API.
Base Command
cbd-get-alert-details
Input
| Argument Name | Description | Required |
|---|---|---|
| alertId | The ID of the alert. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Alert.org_key | String | The organization key associated with the alert. |
| CarbonBlackDefense.Alert.alert_url | String | The URL to view the alert in the Carbon Black Defense console. |
| CarbonBlackDefense.Alert.id | String | The unique alert ID. |
| CarbonBlackDefense.Alert.type | String | The type of the alert. |
| CarbonBlackDefense.Alert.backend_timestamp | Date | The timestamp when the alert was generated in the backend. |
| CarbonBlackDefense.Alert.user_update_timestamp | Date | The timestamp when the alert was last updated by a user. |
| CarbonBlackDefense.Alert.backend_update_timestamp | Date | The timestamp when the alert was last updated in the backend. |
| CarbonBlackDefense.Alert.detection_timestamp | Date | The timestamp when the alert was detected. |
| CarbonBlackDefense.Alert.first_event_timestamp | Date | The timestamp of the first event related to the alert. |
| CarbonBlackDefense.Alert.last_event_timestamp | Date | The timestamp of the last event related to the alert. |
| CarbonBlackDefense.Alert.severity | Number | The severity level of the alert. |
| CarbonBlackDefense.Alert.reason | String | The reason for the alert. |
| CarbonBlackDefense.Alert.reason_code | String | The reason code for the alert. |
| CarbonBlackDefense.Alert.threat_id | String | The threat ID related to the alert. |
| CarbonBlackDefense.Alert.primary_event_id | String | The primary event ID related to the alert. |
| CarbonBlackDefense.Alert.policy_applied | String | The policy applied to the device when the alert was generated. |
| CarbonBlackDefense.Alert.run_state | String | The run state of the alert. |
| CarbonBlackDefense.Alert.sensor_action | String | The action taken by the sensor for the alert. |
| CarbonBlackDefense.Alert.workflow.change_timestamp | Date | The timestamp when the workflow status was last changed. |
| CarbonBlackDefense.Alert.workflow.changed_by_type | String | The type of user who last changed the workflow status. |
| CarbonBlackDefense.Alert.workflow.changed_by | String | The user who last changed the workflow status. |
| CarbonBlackDefense.Alert.workflow.closure_reason | String | The reason for closing the alert. |
| CarbonBlackDefense.Alert.workflow.status | String | The current workflow status of the alert. |
| CarbonBlackDefense.Alert.determination.change_timestamp | Date | The timestamp when the determination was last changed. |
| CarbonBlackDefense.Alert.determination.value | String | The value of the determination. |
| CarbonBlackDefense.Alert.determination.changed_by_type | String | The type of user who last changed the determination. |
| CarbonBlackDefense.Alert.determination.changed_by | String | The user who last changed the determination. |
| CarbonBlackDefense.Alert.tags | Unknown | The tags associated with the alert. |
| CarbonBlackDefense.Alert.alert_notes_present | Boolean | Indicates whether alert notes are present. |
| CarbonBlackDefense.Alert.threat_notes_present | Boolean | Indicates whether threat notes are present. |
| CarbonBlackDefense.Alert.alert_origin | String | The origin of the alert. |
| CarbonBlackDefense.Alert.is_updated | Boolean | Indicates whether the alert has been updated. |
| CarbonBlackDefense.Alert.device_id | Number | The identifier of the device related to the alert. |
| CarbonBlackDefense.Alert.device_name | String | The name of the device related to the alert. |
| CarbonBlackDefense.Alert.device_uem_id | String | The Unified Endpoint Management (UEM) ID of the device. |
| CarbonBlackDefense.Alert.device_target_value | String | The target value of the device. |
| CarbonBlackDefense.Alert.device_policy | String | The policy applied to the device. |
| CarbonBlackDefense.Alert.device_policy_id | Number | The policy ID applied to the device. |
| CarbonBlackDefense.Alert.device_os | String | The operating system of the device. |
| CarbonBlackDefense.Alert.device_os_version | String | The operating system version of the device. |
| CarbonBlackDefense.Alert.device_username | String | The username associated with the device. |
| CarbonBlackDefense.Alert.device_location | String | The location of the device. |
| CarbonBlackDefense.Alert.device_external_ip | String | The external IP address of the device. |
| CarbonBlackDefense.Alert.device_internal_ip | String | The internal IP address of the device. |
| CarbonBlackDefense.Alert.asset_group | Unknown | The asset group to which the device belongs. |
| CarbonBlackDefense.Alert.mdr_alert | Boolean | Indicates whether the alert is a Managed Detection and Response (MDR) alert. |
| CarbonBlackDefense.Alert.mdr_alert_notes_present | Boolean | Indicates whether MDR alert notes are present. |
| CarbonBlackDefense.Alert.mdr_threat_notes_present | Boolean | Indicates whether MDR threat notes are present. |
| CarbonBlackDefense.Alert.report_id | String | The report ID associated with the alert. |
| CarbonBlackDefense.Alert.report_name | String | The name of the report associated with the alert. |
| CarbonBlackDefense.Alert.report_description | String | The description of the report associated with the alert. |
| CarbonBlackDefense.Alert.report_tags | String | The tags associated with the report. |
| CarbonBlackDefense.Alert.report_link | String | The link to the report associated with the alert. |
| CarbonBlackDefense.Alert.ioc_id | String | The indicator of compromise (IOC) ID related to the alert. |
| CarbonBlackDefense.Alert.ioc_hit | String | The IOC hit associated with the alert. |
| CarbonBlackDefense.Alert.watchlists.id | String | The watchlist ID associated with the alert. |
| CarbonBlackDefense.Alert.watchlists.name | String | The name of the watchlist associated with the alert. |
| CarbonBlackDefense.Alert.process_guid | String | The GUID of the process related to the alert. |
| CarbonBlackDefense.Alert.process_pid | Number | The PID of the process related to the alert. |
| CarbonBlackDefense.Alert.process_name | String | The name of the process related to the alert. |
| CarbonBlackDefense.Alert.process_sha256 | String | The SHA-256 hash of the process related to the alert. |
| CarbonBlackDefense.Alert.process_md5 | String | The MD5 hash of the process related to the alert. |
| CarbonBlackDefense.Alert.process_effective_reputation | String | The effective reputation of the process related to the alert. |
| CarbonBlackDefense.Alert.process_reputation | String | The reputation of the process related to the alert. |
| CarbonBlackDefense.Alert.process_cmdline | String | The command line of the process related to the alert. |
| CarbonBlackDefense.Alert.process_username | String | The username associated with the process related to the alert. |
| CarbonBlackDefense.Alert.process_issuer | String | The issuer of the process related to the alert. |
| CarbonBlackDefense.Alert.process_publisher | String | The publisher of the process related to the alert. |
| CarbonBlackDefense.Alert.parent_guid | String | The GUID of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_pid | Number | The PID of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_name | String | The name of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_sha256 | String | The SHA-256 hash of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_md5 | String | The MD5 hash of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_effective_reputation | String | The effective reputation of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_reputation | String | The reputation of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_cmdline | String | The command line of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_username | String | The username associated with the parent process related to the alert. |
| CarbonBlackDefense.Alert.childproc_guid | String | The GUID of the child process related to the alert. |
| CarbonBlackDefense.Alert.childproc_username | String | The username associated with the child process related to the alert. |
| CarbonBlackDefense.Alert.childproc_cmdline | String | The command line of the child process related to the alert. |
| CarbonBlackDefense.Alert.ml_classification_final_verdict | String | The final verdict from the machine learning classification. |
| CarbonBlackDefense.Alert.ml_classification_global_prevalence | String | The global prevalence from the machine learning classification. |
| CarbonBlackDefense.Alert.ml_classification_org_prevalence | String | The organizational prevalence from the machine learning classification. |
| CarbonBlackDefense.Alert.ml_classification_anomalies | Unknown | The anomalies identified by the machine learning classification. |
Command example
!cbd-get-alert-details alertId=abc-123
Context Example
{
"CarbonBlackDefense": {
"Alert": {
"alert_notes_present": true,
"alert_origin": "ALERT_ORIGIN_UNKNOWN",
"alert_url": "dummy_alert_url",
"asset_group": [],
"backend_timestamp": "2024-03-26T14:05:42.311Z",
"backend_update_timestamp": "2024-03-26T14:05:42.311Z",
"childproc_cmdline": "",
"childproc_guid": "",
"childproc_username": "",
"detection_timestamp": "2024-03-26T14:04:49.358Z",
"determination": {
"change_timestamp": "2024-04-07T15:08:37.805Z",
"changed_by": "BG6UTMG1LK",
"changed_by_type": "API",
"value": "NONE"
},
"device_external_ip": "1.1.1.1",
"device_id": "dummy_device_id",
"device_internal_ip": "1.1.1.1",
"device_location": "UNKNOWN",
"device_name": "EIP\\WW-20002",
"device_os": "WINDOWS",
"device_os_version": "Windows 10 x64",
"device_policy": "default",
"device_policy_id": "dummy_device_policy_id",
"device_target_value": "MEDIUM",
"device_uem_id": "",
"device_username": "EIP\\Administrator",
"first_event_timestamp": "2024-03-26T14:00:05.730Z",
"id": "dummy_id",
"ioc_hit": "(fileless_scriptload_cmdline:Register-ScheduledTask OR fileless_scriptload_cmdline:New-ScheduledTask OR scriptload_content:Register-ScheduledTask OR scriptload_content:New-ScheduledTask) AND NOT (process_cmdline:windows\\\\ccm\\\\systemtemp OR crossproc_name:windows\\\\ccm\\\\ccmexec.exe OR (process_publisher:\"VMware, Inc.\" AND process_publisher_state:FILE_SIGNATURE_STATE_TRUSTED))",
"ioc_id": "dummy_ioc_id",
"is_updated": false,
"last_event_timestamp": "2024-03-26T14:00:05.730Z",
"mdr_alert": false,
"mdr_alert_notes_present": false,
"mdr_threat_notes_present": false,
"ml_classification_anomalies": [],
"ml_classification_final_verdict": "NOT_ANOMALOUS",
"ml_classification_global_prevalence": "LOW",
"ml_classification_org_prevalence": "LOW",
"org_key": "dummy_org_key",
"parent_cmdline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule",
"parent_effective_reputation": "TRUSTED_WHITE_LIST",
"parent_guid": "dummy_parent_guid",
"parent_md5": "dummy_parent_md5",
"parent_name": "c:\\windows\\system32\\svchost.exe",
"parent_pid": "dummy_parent_pid",
"parent_reputation": "TRUSTED_WHITE_LIST",
"parent_sha256": "dummy_parent_sha256",
"parent_username": "NT AUTHORITY\\SYSTEM",
"policy_applied": "NOT_APPLIED",
"primary_event_id": "dummy_primary_event_id",
"process_cmdline": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EP Bypass \\\\eip.demo\\sysvol\\EIP.DEMO\\scripts\\Luminol.ps1",
"process_effective_reputation": "TRUSTED_WHITE_LIST",
"process_guid": "dummy_process_guid",
"process_issuer": [
"Microsoft Windows Production PCA 2011"
],
"process_md5": "dummy_parent_md5",
"process_name": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"process_pid": "dummy_process_pid",
"process_publisher": [
"Microsoft Windows"
],
"process_reputation": "TRUSTED_WHITE_LIST",
"process_sha256": "dummy_process_sha256",
"process_username": "NT AUTHORITY\\SYSTEM",
"reason": "Process powershell.exe was detected by the report \"Execution - AMSI - New Fileless Scheduled Task Behavior Detected\" in watchlist \"AMSI Threat Intelligence\"",
"reason_code": "dummy_reason_code",
"report_description": "Newer Powershell versions introduced built-in cmdlets to manage scheduled tasks natively without calling out to typical scheduled task processes like at.exe or schtasks.exe. This detection looks for behaviors related to the fileless execution of scheduled tasks. If you are responding to this alert, be sure to correlate the fileless scriptload events with events typically found in your environment Generally, attackers will create scheduled tasks with binaries that are located in user writable directories like AppData, Temp, or public folders.",
"report_id": "dummy_report_id",
"report_link": "https://attack.mitre.org/techniques/T1053/",
"report_name": "Execution - AMSI - New Fileless Scheduled Task Behavior Detected",
"report_tags": [
"execution",
"privesc",
"persistence",
"t1053",
"windows",
"amsi",
"attack",
"attackframework"
],
"run_state": "RAN",
"sensor_action": "ALLOW",
"severity": 5,
"tags": null,
"threat_id": "dummy_threat_id",
"threat_notes_present": false,
"type": "WATCHLIST",
"user_update_timestamp": "2024-04-07T15:31:33.704Z",
"watchlists": [
{
"id": "dummy_id",
"name": "AMSI Threat Intelligence"
}
],
"workflow": {
"change_timestamp": "2024-04-07T15:31:33.704Z",
"changed_by": "3LGD624UYW",
"changed_by_type": "API",
"closure_reason": "OTHER",
"status": "OPEN"
}
}
}
}
Human Readable Output
Carbon Black Defense Get Alert Details
Id Device Id Device Name Device Username Ioc Hit Reason Type Threat Id Device Policy Severity dummy_id 6612391 EIP\WW-20002 EIP\Administrator (fileless_scriptload_cmdline:Register-ScheduledTask OR fileless_scriptload_cmdline:New-ScheduledTask OR scriptload_content:Register-ScheduledTask OR scriptload_content:New-ScheduledTask) AND NOT (process_cmdline:windows\ccm\systemtemp OR crossproc_name:windows\ccm\ccmexec.exe OR (process_publisher:”VMware, Inc.” AND process_publisher_state:FILE_SIGNATURE_STATE_TRUSTED)) Process powershell.exe was detected by the report “Execution - AMSI - New Fileless Scheduled Task Behavior Detected” in watchlist “AMSI Threat Intelligence” WATCHLIST C21CA826573A8D974C1E93C8471AAB7F default 5
cbd-alerts-search
Gets alert details, including alert metadata and the event associated with the alert.
Base Command
cbd-alerts-search
Input
| Argument Name | Description | Required |
|---|---|---|
| type | The alert type. Possible values are: cbanalytics, containerruntime, devicecontrol, hostnasedfirewall, intrusiondetectionsystem, watchlist, all. Default is all. | Optional |
| device_id | The device ID. | Optional |
| first_event_time | The time of the first event associated with the alert. The syntax is {“start”: “<dateTime>”, “range”: “<string>”, “end”: “<dateTime>” }. For example: { “start”: “2010-09-25T00:10:50.277Z”, “end”: “2015-01-20T10:40:00.00Z”}. | Optional |
| policy_id | The policy ID. | Optional |
| process_sha256 | The SHA-256 hash of the primary involved process. | Optional |
| reputation | The reputation of the primary involved process. Possible values are: ADAPTIVE_WHITE_LIST, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, PUP, TRUSTED_WHITE_LIST, RESOLVING, COMPROMISED_OBSOLETE, DLP_OBSOLETE, IGNORE, ADWARE, HEURISTIC, SUSPECT_MALWARE, KNOWN_MALWARE, ADMIN_RESTRICT_OBSOLETE, NOT_LISTED, GRAY_OBSOLETE, NOT_COMPANY_WHITE_OBSOLETE, LOCAL_WHITE, NOT_SUPPORTED. | Optional |
| tags | The tags associated with the alert. | Optional |
| device_username | The username of the user logged on during the alert. If the user is not available, the device owner is used. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of results to be returned. | Optional |
| start | The number of the alert from where to start retrieving results. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Alert.org_key | String | The organization key associated with the alert. |
| CarbonBlackDefense.Alert.alert_url | String | The URL to view the alert in the Carbon Black Defense console. |
| CarbonBlackDefense.Alert.id | String | The unique alert ID. |
| CarbonBlackDefense.Alert.type | String | The type of the alert. |
| CarbonBlackDefense.Alert.backend_timestamp | Date | The timestamp when the alert was generated in the backend. |
| CarbonBlackDefense.Alert.user_update_timestamp | Unknown | The timestamp when the alert was last updated by a user. |
| CarbonBlackDefense.Alert.backend_update_timestamp | Date | The timestamp when the alert was last updated in the backend. |
| CarbonBlackDefense.Alert.detection_timestamp | Date | The timestamp when the alert was detected. |
| CarbonBlackDefense.Alert.first_event_timestamp | Date | The timestamp of the first event related to the alert. |
| CarbonBlackDefense.Alert.last_event_timestamp | Date | The timestamp of the last event related to the alert. |
| CarbonBlackDefense.Alert.severity | Number | The severity level of the alert. |
| CarbonBlackDefense.Alert.reason | String | The reason for the alert. |
| CarbonBlackDefense.Alert.reason_code | String | The reason code for the alert. |
| CarbonBlackDefense.Alert.threat_id | String | The unique alert ID |
| CarbonBlackDefense.Alert.primary_event_id | String | The primary event ID related to the alert. |
| CarbonBlackDefense.Alert.policy_applied | String | The policy applied to the device when the alert was generated. |
| CarbonBlackDefense.Alert.run_state | String | The run state of the alert. |
| CarbonBlackDefense.Alert.sensor_action | String | The action taken by the sensor for the alert. |
| CarbonBlackDefense.Alert.workflow.change_timestamp | Date | The timestamp when the workflow status was last changed. |
| CarbonBlackDefense.Alert.workflow.changed_by_type | String | The type of user who last changed the workflow status. |
| CarbonBlackDefense.Alert.workflow.changed_by | String | The user who last changed the workflow status. |
| CarbonBlackDefense.Alert.workflow.closure_reason | String | The reason for closing the alert. |
| CarbonBlackDefense.Alert.workflow.status | String | The current workflow status of the alert. |
| CarbonBlackDefense.Alert.determination.change_timestamp | Date | The timestamp when the determination was last changed. |
| CarbonBlackDefense.Alert.determination.value | String | The value of the determination. |
| CarbonBlackDefense.Alert.determination.changed_by_type | String | The type of user who last changed the determination. |
| CarbonBlackDefense.Alert.determination.changed_by | String | The user who last changed the determination. |
| CarbonBlackDefense.Alert.tags | Unknown | The tags associated with the alert. |
| CarbonBlackDefense.Alert.alert_notes_present | Boolean | Indicates whether alert notes are present. |
| CarbonBlackDefense.Alert.threat_notes_present | Boolean | Indicates whether threat notes are present. |
| CarbonBlackDefense.Alert.alert_origin | String | The origin of the alert. |
| CarbonBlackDefense.Alert.is_updated | Boolean | Indicates whether the alert has been updated. |
| CarbonBlackDefense.Alert.device_id | Number | The device ID related to the alert. |
| CarbonBlackDefense.Alert.device_name | String | The name of the device related to the alert. |
| CarbonBlackDefense.Alert.device_uem_id | String | The Unified Endpoint Management (UEM) ID of the device. |
| CarbonBlackDefense.Alert.device_target_value | String | The target value of the device. |
| CarbonBlackDefense.Alert.device_policy | String | The policy applied to the device. |
| CarbonBlackDefense.Alert.device_policy_id | Number | The policy ID applied to the device. |
| CarbonBlackDefense.Alert.device_os | String | The operating system of the device. |
| CarbonBlackDefense.Alert.device_os_version | String | The operating system version of the device. |
| CarbonBlackDefense.Alert.device_username | String | The username associated with the device. |
| CarbonBlackDefense.Alert.device_location | String | The location of the device. |
| CarbonBlackDefense.Alert.device_external_ip | String | The external IP address of the device. |
| CarbonBlackDefense.Alert.device_internal_ip | String | The internal IP address of the device. |
| CarbonBlackDefense.Alert.asset_group | Unknown | The asset group to which the device belongs. |
| CarbonBlackDefense.Alert.mdr_alert | Boolean | Indicates whether the alert is an MDR (Managed Detection and Response) alert. |
| CarbonBlackDefense.Alert.mdr_alert_notes_present | Boolean | Indicates whether MDR alert notes are present. |
| CarbonBlackDefense.Alert.mdr_threat_notes_present | Boolean | Indicates whether MDR threat notes are present. |
| CarbonBlackDefense.Alert.report_id | String | The report ID associated with the alert. |
| CarbonBlackDefense.Alert.report_name | String | The name of the report associated with the alert. |
| CarbonBlackDefense.Alert.report_tags | Unknown | The tags associated with the report. |
| CarbonBlackDefense.Alert.ioc_id | String | The indicator of compromise (IOC) ID related to the alert. |
| CarbonBlackDefense.Alert.ioc_hit | String | The IOC hit associated with the alert. |
| CarbonBlackDefense.Alert.watchlists.id | String | The watchlist ID associated with the alert. |
| CarbonBlackDefense.Alert.watchlists.name | String | The name of the watchlist associated with the alert. |
| CarbonBlackDefense.Alert.process_guid | String | The GUID of the process related to the alert. |
| CarbonBlackDefense.Alert.process_pid | Number | The PID of the process related to the alert. |
| CarbonBlackDefense.Alert.process_name | String | The name of the process related to the alert. |
| CarbonBlackDefense.Alert.process_sha256 | String | The SHA-256 hash of the process related to the alert. |
| CarbonBlackDefense.Alert.process_md5 | String | The MD5 hash of the process related to the alert. |
| CarbonBlackDefense.Alert.process_effective_reputation | String | The effective reputation of the process related to the alert. |
| CarbonBlackDefense.Alert.process_reputation | String | The reputation of the process related to the alert. |
| CarbonBlackDefense.Alert.process_cmdline | String | The command line of the process related to the alert. |
| CarbonBlackDefense.Alert.process_username | String | The username associated with the process related to the alert. |
| CarbonBlackDefense.Alert.process_issuer | String | The issuer of the process related to the alert. |
| CarbonBlackDefense.Alert.process_publisher | String | The publisher of the process related to the alert. |
| CarbonBlackDefense.Alert.parent_guid | String | The GUID of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_pid | Number | The PID of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_name | String | The name of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_sha256 | String | The SHA-256 hash of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_md5 | String | The MD5 hash of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_effective_reputation | String | The effective reputation of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_reputation | String | The reputation of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_cmdline | String | The command line of the parent process related to the alert. |
| CarbonBlackDefense.Alert.parent_username | String | The username associated with the parent process related to the alert. |
| CarbonBlackDefense.Alert.childproc_guid | String | The GUID of the child process related to the alert. |
| CarbonBlackDefense.Alert.childproc_username | String | The username associated with the child process related to the alert. |
| CarbonBlackDefense.Alert.childproc_cmdline | String | The command line of the child process related to the alert. |
Command example
!cbd-alerts-search reputation=NOT_LISTED rows=3 type=all
Context Example
{
"CarbonBlackDefense": {
"Alert": [
{
"alert_notes_present": false,
"alert_origin": "ALERT_ORIGIN_UNKNOWN",
"alert_url": "dummy_alert_url",
"asset_group": [],
"backend_timestamp": "2024-07-09T12:22:14.999Z",
"backend_update_timestamp": "2024-07-09T12:22:14.999Z",
"childproc_cmdline": "",
"childproc_guid": "",
"childproc_username": "",
"detection_timestamp": "2024-07-09T12:21:10.168Z",
"determination": {
"change_timestamp": "2024-07-09T12:22:14.999Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"value": "NONE"
},
"device_external_ip": "1.1.1.1",
"device_id": "dummy_device_id",
"device_internal_ip": "1.1.1.1",
"device_location": "UNKNOWN",
"device_name": "win1122H2new",
"device_os": "WINDOWS",
"device_os_version": "Windows 11 x64",
"device_policy": "⚠️ Wide Open",
"device_policy_id": "dummy_device_policy_id",
"device_target_value": "LOW",
"device_uem_id": "",
"device_username": "Administrator",
"first_event_timestamp": "2024-07-09T12:19:01.963Z",
"id": "dummy_id",
"ioc_field": "netconn_ipv4",
"ioc_hit": "1.1.1.1",
"ioc_id": "dummy_ioc_id",
"is_updated": false,
"last_event_timestamp": "2024-07-09T12:19:01.963Z",
"mdr_alert": false,
"mdr_alert_notes_present": false,
"mdr_threat_notes_present": false,
"org_key": "dummy_org_key",
"parent_cmdline": "C:\\Windows\\system32\\services.exe",
"parent_effective_reputation": "TRUSTED_WHITE_LIST",
"parent_guid": "dummy_parent_guid",
"parent_md5": "dummy_parent_md5",
"parent_name": "c:\\windows\\system32\\services.exe",
"parent_pid": "dummy_parent_pid",
"parent_reputation": "TRUSTED_WHITE_LIST",
"parent_sha256": "dummy_parent_sha256",
"parent_username": "NT AUTHORITY\\SYSTEM",
"policy_applied": "NOT_APPLIED",
"primary_event_id": "dummy_primary_event_id",
"process_cmdline": "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentSvc.exe\"",
"process_effective_reputation": "LOCAL_WHITE",
"process_guid": "dummy_process_guid",
"process_issuer": [
""
],
"process_md5": "dummy_parent_md5",
"process_name": "c:\\program files (x86)\\netskope\\stagent\\stagentsvc.exe",
"process_pid": "dummy_process_pid",
"process_publisher": [
""
],
"process_reputation": "NOT_LISTED",
"process_sha256": "dummy_process_sha256",
"process_username": "NT AUTHORITY\\SYSTEM",
"reason": "Process stagentsvc.exe was detected by the report \"crest test-netconn_ipv4-1\" in watchlist \"Crest test\"",
"reason_code": "dummy_reason_code",
"report_description": "Service Now Threat Intel",
"report_id": "dummy_report_id",
"report_link": "https://dev188630.service-now.com/",
"report_name": "crest test-netconn_ipv4-1",
"report_tags": [],
"run_state": "RAN",
"sensor_action": "ALLOW",
"severity": 5,
"tags": null,
"threat_id": "dummy_threat_id",
"threat_notes_present": false,
"type": "WATCHLIST",
"user_update_timestamp": null,
"watchlists": [
{
"id": "dummy_id",
"name": "Crest test"
}
],
"workflow": {
"change_timestamp": "2024-07-09T12:22:14.999Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"closure_reason": "NO_REASON",
"status": "OPEN"
}
},
{
"alert_notes_present": false,
"alert_origin": "ALERT_ORIGIN_UNKNOWN",
"alert_url": "dummy_alert_url",
"asset_group": [],
"backend_timestamp": "2024-07-09T11:55:04.223Z",
"backend_update_timestamp": "2024-07-09T11:55:04.223Z",
"childproc_cmdline": "",
"childproc_guid": "",
"childproc_username": "",
"detection_timestamp": "2024-07-09T11:53:53.751Z",
"determination": {
"change_timestamp": "2024-07-09T11:55:04.223Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"value": "NONE"
},
"device_external_ip": "1.1.1.1",
"device_id": "dummy_device_id",
"device_internal_ip": "1.1.1.1",
"device_location": "UNKNOWN",
"device_name": "win1122H2new",
"device_os": "WINDOWS",
"device_os_version": "Windows 11 x64",
"device_policy": "⚠️ Wide Open",
"device_policy_id": "dummy_device_policy_id",
"device_target_value": "LOW",
"device_uem_id": "",
"device_username": "Administrator",
"first_event_timestamp": "2024-07-09T11:51:44.217Z",
"id": "dummy_id",
"ioc_field": "netconn_ipv4",
"ioc_hit": "1.1.1.1",
"ioc_id": "dummy_ioc_id",
"is_updated": false,
"last_event_timestamp": "2024-07-09T11:51:44.217Z",
"mdr_alert": false,
"mdr_alert_notes_present": false,
"mdr_threat_notes_present": false,
"org_key": "dummy_org_key",
"parent_cmdline": "",
"parent_effective_reputation": "TRUSTED_WHITE_LIST",
"parent_guid": "dummy_parent_guid",
"parent_md5": "",
"parent_name": "c:\\windows\\system32\\services.exe",
"parent_pid": "dummy_parent_pid",
"parent_reputation": "TRUSTED_WHITE_LIST",
"parent_sha256": "dummy_parent_sha256",
"parent_username": "NT AUTHORITY\\SYSTEM",
"policy_applied": "NOT_APPLIED",
"primary_event_id": "dummy_primary_event_id",
"process_cmdline": "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentSvc.exe\"",
"process_effective_reputation": "LOCAL_WHITE",
"process_guid": "dummy_process_guid",
"process_issuer": [],
"process_md5": "",
"process_name": "c:\\program files (x86)\\netskope\\stagent\\stagentsvc.exe",
"process_pid": "dummy_process_pid",
"process_publisher": [],
"process_reputation": "NOT_LISTED",
"process_sha256": "dummy_process_sha256",
"process_username": "NT AUTHORITY\\SYSTEM",
"reason": "Process stagentsvc.exe was detected by the report \"crest test-netconn_ipv4-1\" in watchlist \"Crest test\"",
"reason_code": "dummy_reason_code",
"report_description": "Service Now Threat Intel",
"report_id": "dummy_report_id",
"report_link": "https://dev188630.service-now.com/",
"report_name": "crest test-netconn_ipv4-1",
"report_tags": [],
"run_state": "RAN",
"sensor_action": "ALLOW",
"severity": 5,
"tags": null,
"threat_id": "dummy_threat_id",
"threat_notes_present": false,
"type": "WATCHLIST",
"user_update_timestamp": null,
"watchlists": [
{
"id": "dummy_id",
"name": "Crest test"
}
],
"workflow": {
"change_timestamp": "2024-07-09T11:55:04.223Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"closure_reason": "NO_REASON",
"status": "OPEN"
}
},
{
"alert_notes_present": false,
"alert_origin": "ALERT_ORIGIN_UNKNOWN",
"alert_url": "dummy_alert_url",
"asset_group": [],
"backend_timestamp": "2024-07-09T11:54:49.999Z",
"backend_update_timestamp": "2024-07-09T11:54:49.999Z",
"childproc_cmdline": "",
"childproc_guid": "",
"childproc_username": "",
"detection_timestamp": "2024-07-09T11:53:53.750Z",
"determination": {
"change_timestamp": "2024-07-09T11:54:49.999Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"value": "NONE"
},
"device_external_ip": "1.1.1.1",
"device_id": "dummy_device_id",
"device_internal_ip": "1.1.1.1",
"device_location": "UNKNOWN",
"device_name": "win1122H2new",
"device_os": "WINDOWS",
"device_os_version": "Windows 11 x64",
"device_policy": "⚠️ Wide Open",
"device_policy_id": "dummy_device_policy_id",
"device_target_value": "LOW",
"device_uem_id": "",
"device_username": "Administrator",
"first_event_timestamp": "2024-07-09T11:51:44.218Z",
"id": "dummy_id",
"ioc_field": "netconn_ipv4",
"ioc_hit": "1.1.1.1",
"ioc_id": "dummy_ioc_id",
"is_updated": false,
"last_event_timestamp": "2024-07-09T11:51:44.218Z",
"mdr_alert": false,
"mdr_alert_notes_present": false,
"mdr_threat_notes_present": false,
"org_key": "dummy_org_key",
"parent_cmdline": "",
"parent_effective_reputation": "TRUSTED_WHITE_LIST",
"parent_guid": "dummy_parent_guid",
"parent_md5": "",
"parent_name": "c:\\windows\\system32\\services.exe",
"parent_pid": "dummy_parent_pid",
"parent_reputation": "TRUSTED_WHITE_LIST",
"parent_sha256": "dummy_parent_sha256",
"parent_username": "NT AUTHORITY\\SYSTEM",
"policy_applied": "NOT_APPLIED",
"primary_event_id": "dummy_primary_event_id",
"process_cmdline": "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentSvc.exe\"",
"process_effective_reputation": "LOCAL_WHITE",
"process_guid": "dummy_process_guid",
"process_issuer": [],
"process_md5": "",
"process_name": "c:\\program files (x86)\\netskope\\stagent\\stagentsvc.exe",
"process_pid": "dummy_process_pid",
"process_publisher": [],
"process_reputation": "NOT_LISTED",
"process_sha256": "dummy_process_sha256",
"process_username": "NT AUTHORITY\\SYSTEM",
"reason": "Process stagentsvc.exe was detected by the report \"crest test-netconn_ipv4-1\" in watchlist \"Crest test\"",
"reason_code": "dummy_reason_code",
"report_description": "Service Now Threat Intel",
"report_id": "dummy_report_id",
"report_link": "https://dev188630.service-now.com/",
"report_name": "crest test-netconn_ipv4-1",
"report_tags": [],
"run_state": "RAN",
"sensor_action": "ALLOW",
"severity": 5,
"tags": null,
"threat_id": "dummy_threat_id",
"threat_notes_present": false,
"type": "WATCHLIST",
"user_update_timestamp": null,
"watchlists": [
{
"id": "dummy_id",
"name": "Crest test"
}
],
"workflow": {
"change_timestamp": "2024-07-09T11:54:49.999Z",
"changed_by": "ALERT_CREATION",
"changed_by_type": "SYSTEM",
"closure_reason": "NO_REASON",
"status": "OPEN"
}
}
]
}
}
Human Readable Output
Carbon Black Defense Alerts List Results
Id Device Id Device Name Device Username Backend Timestamp dummy_id 8213794 win1122H2new Administrator 2024-07-09T12:22:14.999Z dummy_id 8213794 win1122H2new Administrator 2024-07-09T11:55:04.223Z dummy_id 8213794 win1122H2new Administrator 2024-07-09T11:54:49.999Z
cbd-get-policy
Retrieves a policy object by ID.
Base Command
cbd-get-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for automatically deregistering inactive VDI (Virtual Desktop Infrastructure) devices. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for automatically deregistering inactive VM (Virtual Machine) workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates whether the Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay in milliseconds for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size in bytes that can be uploaded to Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level assigned by Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates whether the on-access scan is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of the on-access scan. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates whether the on-demand scan is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile used for the on-demand scan. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates whether the on-demand scan includes CD/DVD drives. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates whether the on-demand scan includes USB drives. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for scheduling the on-demand scan. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates whether a recovery scan is performed if the scheduled scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for scheduling the on-demand scan. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates whether signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for scheduling signature updates. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for scheduling signature updates. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for scheduling signature updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The update servers used for offsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates whether the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The update server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates whether the update servers override the default settings. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates whether file uploads are allowed by the directory action rule. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The directory path specified by the action rule. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates whether protection is enabled for the directory action rule. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates whether the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configuration. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configuration. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The unique rule configuration ID. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | The source from which the rule configuration is inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configuration. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_network_data_collection | Boolean | Indicates whether network data collection is enabled. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_auth_events | Boolean | Indicates whether authentication events are enabled. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.WindowsAssignmentMode | String | The Windows assignment mode for the rule configuration. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configuration. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.action | String | The default action of the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_access_check_guid | String | The access check GUID for the default rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_inbound_event_check_guid | String | The inbound event check GUID for the default rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_outbound_event_check_guid | String | The outbound event check GUID for the default rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_host_based_firewall | Boolean | Indicates whether the host-based firewall is enabled. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.description | String | A description of the rule group. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.name | String | The name of the rule group. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.action | String | The action specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.application_path | String | The application path specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.direction | String | The direction (inbound or outbound) specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.enabled | Boolean | Indicates whether the rule is enabled. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.local_ip_address | String | The local IP address specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.local_port_ranges | String | The local port ranges specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.name | String | The name of the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.network_profile | String | The network profile specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.protocol | String | The protocol specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.remote_ip_address | String | The remote IP address specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.remote_port_ranges | String | The remote port ranges specified by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_access_check_guid | String | The access check GUID for the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_inbound_event_check_guid | String | The inbound event check GUID for the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_outbound_event_check_guid | String | The outbound event check GUID for the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.test_mode | Boolean | Indicates whether the rule is in test mode. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.threat_score | Number | The threat score assigned by the rule. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.ruleset_id | String | The ID of the rule set. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates whether the UBS (User Behavior Settings) opt-in is enabled. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates whether prevalent module event collection is enabled. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified by the rule. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified by the rule. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified by the rule. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The unique rule ID. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified by the rule. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates whether the rule is required. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configuration. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configuration. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The unique sensor configuration ID. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | The source from which the sensor configuration is inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configuration. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode specified by the sensor configuration. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor setting. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor setting. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The last update time of the policy. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
Command example
!cbd-get-policy policyId=80947
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "aaaaaaaa",
"id": "dummy_id",
"name": "AWN BAS",
"policy": {
"auto_deregister_inactive_vdi_interval_ms": 0,
"auto_deregister_inactive_vm_workloads_interval_ms": 0,
"av_settings": {
"avira_protection_cloud": {
"enabled": false,
"max_exe_delay": 45,
"max_file_size": 4,
"risk_level": 4
},
"on_access_scan": {
"enabled": true,
"mode": "AGGRESSIVE"
},
"on_demand_scan": {
"enabled": true,
"profile": "NORMAL",
"scan_cd_dvd": "AUTOSCAN",
"scan_usb": "AUTOSCAN",
"schedule": {
"range_hours": 0,
"recovery_scan_if_missed": true,
"start_hour": 0
}
},
"signature_update": {
"enabled": true,
"schedule": {
"full_interval_hours": 0,
"initial_random_delay_hours": 4,
"interval_hours": 4
}
},
"update_servers": {
"servers_for_offsite_devices": [
"http://updates2.cdc.carbonblack.io/update2"
],
"servers_for_onsite_devices": [
{
"preferred": false,
"server": "http://updates2.cdc.carbonblack.io/update2"
}
],
"servers_override": []
}
},
"directory_action_rules": [
{
"file_upload": false,
"path": "",
"protection": false
}
],
"is_system": false,
"org_key": "dummy_org_key",
"position": 1,
"rule_configs": [
{
"category": "data_collection",
"description": "Turns on XDR network data collection at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "XDR",
"parameters": {
"enable_network_data_collection": true
}
},
{
"category": "data_collection",
"description": "Turns on Windows authentication events at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "Authentication Events",
"parameters": {
"enable_auth_events": false
}
},
{
"category": "core_prevention",
"description": "Addresses malicious fileless and file-backed scripts that leverage native programs and common scripting languages.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Advanced Scripting Prevention",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "core_prevention",
"description": "Addresses threat actors obtaining credentials and relies on detecting the malicious use of TTPs/behaviors that indicate such activity.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Credential Theft",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "core_prevention",
"description": "Addresses common and pervasive TTPs used for malicious activity as well as living off the land TTPs/behaviors detected by Carbon Black’s Threat Analysis Unit.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Carbon Black Threat Intel",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "core_prevention",
"description": "Addresses behaviors that indicate a threat actor has gained elevated access via a bug or misconfiguration within an operating system, and leverages the detection of TTPs/behaviors to prevent such activity.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Privilege Escalation",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "core_prevention",
"description": "Addresses common TTPs/behaviors that threat actors use to avoid detection such as uninstalling or disabling security software, obfuscating or encrypting data/scripts and abusing trusted processes to hide and disguise their malicious activity.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Defense Evasion",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "core_prevention",
"description": "Addresses common TTPs/behaviors that threat actors use to retain access to systems across restarts, changed credentials, and other interruptions that could cut off their access.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Persistence",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes and process events from reporting to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting and Sensor Operation Exclusions",
"parameters": {}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes from reporting events to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting Exclusions",
"parameters": {}
},
{
"category": "host_based_firewall",
"description": "These are the Host based Firewall Rules which will be executed by the sensor. The Definition will be part of Main Policies.",
"id": "dummy_id",
"inherited_from": "",
"name": "Host Based Firewall",
"parameters": {
"default_rule": {
"action": "ALLOW",
"default_rule_access_check_guid": "dummy_default_rule_access_check_guid",
"default_rule_inbound_event_check_guid": "dummy_default_rule_inbound_event_check_guid",
"default_rule_outbound_event_check_guid": "dummy_default_rule_outbound_event_check_guid"
},
"enable_host_based_firewall": true,
"rule_groups": [
{
"description": "C&C used by SocGholish",
"name": "Block C&C Traffic",
"rules": [
{
"action": "BLOCK_ALERT",
"application_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"direction": "OUT",
"enabled": true,
"local_ip_address": "*",
"local_port_ranges": "*",
"name": "SocGholish 2024-01-03",
"network_profile": [
"PUBLIC",
"PRIVATE",
"DOMAIN"
],
"protocol": "TCP",
"remote_ip_address": "1.1.1.1/22",
"remote_port_ranges": "443",
"rule_access_check_guid": "dummy_rule_access_check_guid",
"rule_inbound_event_check_guid": "dummy_rule_inbound_event_check_guid",
"rule_outbound_event_check_guid": "dummy_rule_outbound_event_check_guid",
"test_mode": false,
"threat_score": 8
}
],
"ruleset_id": "dummy_ruleset_id"
}
]
}
},
{
"category": "data_collection",
"description": "Enterprise EDR Event Collection",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Enterprise EDR Event Collection",
"parameters": {
"ubs_opt_in": true
}
},
{
"category": "data_collection",
"description": "Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Prevalent Module Exclusions",
"parameters": {
"enable_prevalent_module_event_collection": false
}
}
],
"rules": [
{
"action": "IGNORE",
"application": {
"type": "NAME_PATH",
"value": "COMMON_WHITE_LIST"
},
"id": "dummy_id",
"operation": "RANSOM",
"required": false
}
],
"sensor_configs": [
{
"category": "sensor_settings",
"description": "Manages sensor settings specific to endpoint standard product",
"id": "dummy_id",
"inherited_from": "",
"name": "Endpoint standard sensor settings at policy scope",
"parameters": {
"inline_blocking_mode": "disabled"
}
}
],
"sensor_settings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "LEARNING_MODE",
"value": "0"
},
{
"name": "ALLOW_INLINE_BLOCKING",
"value": "true"
}
],
"update_time": 1720436305029
},
"priorityLevel": "MEDIUM"
}
}
}
Human Readable Output
Carbon Black Defense Policy
Id Name Priority Level Is System Description dummy_id AWN BAS MEDIUM false aaaaaaaa
cbd-get-policies-summary
Get an overview of the policies available in the organization.
Base Command
cbd-get-policies-summary
Input
There are no input arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.PolicySummary.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.PolicySummary.id | Number | The unique policy ID. |
| CarbonBlackDefense.PolicySummary.is_system | Boolean | Indicates whether the policy is a system policy. |
| CarbonBlackDefense.PolicySummary.name | String | The name of the policy. |
| CarbonBlackDefense.PolicySummary.num_devices | Number | The number of devices currently using the policy. |
| CarbonBlackDefense.PolicySummary.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.PolicySummary.priority_level | String | The priority level of the policy. |
| CarbonBlackDefense.PolicySummary.total_num_devices | Number | The total number of devices associated with the policy. |
Command example
#### Context Example
```json
{
"CarbonBlackDefense": {
"PolicySummary": [
{
"description": "aaaaaaaa",
"id": "dummy_id",
"is_system": false,
"name": "AWN BAS",
"num_devices": 2,
"position": 1,
"priority_level": "MEDIUM",
"total_num_devices": 2
},
{
"description": "",
"id": "dummy_id",
"is_system": false,
"name": "Abhi-CB-policy",
"num_devices": 1,
"position": 2,
"priority_level": "LOW",
"total_num_devices": 1
},
{
"description": "Don't worry about this. It won't be here long.",
"id": "dummy_id",
"is_system": false,
"name": "Splunk Policy To_be_deleted_1652997758",
"num_devices": 0,
"position": 39,
"priority_level": "MEDIUM"
},
{
"description": "Splunk Policy invalid value",
"id": "dummy_id",
"is_system": false,
"name": "Splunk Policy invalid value1652962163",
"num_devices": 0,
"position": 42,
"priority_level": "HIGH"
},
{
"description": "aaaaaaaa",
"id": "dummy_id",
"is_system": false,
"name": "test42",
"num_devices": 0,
"position": 107,
"priority_level": "MEDIUM"
}
]
}
}
Human Readable Output
Policies summaries
Id Name Priority Level Is System 80947 AWN BAS MEDIUM false 87816 Abhi-CB-policy LOW false 103786 CBCLOUD Policy MEDIUM false 33819 Cigent Policy HIGH false 68727 Confluera Policy 1 LOW false 69390 Cyborg_Monitor LOW false 102049 DarkNegev MEDIUM false 12147 DefenseStorm Policy MEDIUM false 109968 Devo-MP-Skoville MEDIUM false 105029 EasyNAC domain MEDIUM false 35704 Fortress Policy MISSION_CRITICAL false 130711 Hunters High Test HIGH false 41528 Hunters Policy MEDIUM false 128135 Hunters Policy test MISSION_CRITICAL false 99682 Iron-policy MEDIUM false 63139 LRDemo-JH MEDIUM false 138424 Lions (Victor+Long) MISSION_CRITICAL false 9246 LogRhythm Policy MEDIUM false 104163 Lumu MEDIUM false 65120 Lumu Policy LOW false 96535 Moja Skopska polisa LOW false
cbd-create-policy
Creates a new policy on the CB Defense backend.
Base Command
cbd-create-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A description of the policy. Can be multiple lines. | Optional |
| name | A unique one-line name for the policy. | Optional |
| priorityLevel | The priority score associated with sensors assigned to this policy. Possible values: “MISSION_CRITICAL”, “HIGH”, “MEDIUM”, and “LOW”. | Optional |
| policy | The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy’s fields with the set-policy command, and pass the edited object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VDI. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VM workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates if Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates if on-access scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of on-access scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates if on-demand scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile for on-demand scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates if on-demand scanning of CD/DVD is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates if on-demand scanning of USB devices is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates if a recovery scan is scheduled if the previous scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates if signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The servers used for offsite devices for updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates if the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates if server overrides are enabled for updates. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates if file upload is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The path for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates if protection is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates if the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rapid_configs.description | String | A description of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.id | String | The ID of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from | String | Indicates the source from which the rapid configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rapid_configs.name | String | The name of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection | Boolean | Indicates if network data collection is enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events | Boolean | Indicates if authentication events are enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode | String | The inline blocking mode for rapid configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The ID of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | Indicates the source from which the rule configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates if UBS opt-in is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates if prevalent module event collection is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The ID of the rules. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates if the rules are required. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified in the rules. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The ID of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | Indicates the source from which the sensor configurations are inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode for sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor settings. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor settings. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The time when the policy was last updated. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
Command example
!cbd-create-policy policy="{\"name\": \"test4\", \"description\": \"aaaaaaaa\",\"org_key\": \"7DESJ9GN\", \"priority_level\": \"MEDIUM\", \"rules\": [], \"sensor_settings\": [{\"name\": \"ALLOW_UNINSTALL\", \"value\": \"true\"}]}"
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "aaaaaaaa",
"id": "dummy_id",
"name": "test4",
"policy": {
"auto_deregister_inactive_vdi_interval_ms": 0,
"auto_deregister_inactive_vm_workloads_interval_ms": 0,
"av_settings": {
"avira_protection_cloud": {
"enabled": false,
"max_exe_delay": 45,
"max_file_size": 4,
"risk_level": 4
},
"on_access_scan": {
"enabled": true,
"mode": "NORMAL"
},
"on_demand_scan": {
"enabled": true,
"profile": "NORMAL",
"scan_cd_dvd": "AUTOSCAN",
"scan_usb": "AUTOSCAN",
"schedule": {
"range_hours": 0,
"recovery_scan_if_missed": true,
"start_hour": 0
}
},
"signature_update": {
"enabled": false,
"schedule": {
"full_interval_hours": 0,
"initial_random_delay_hours": 4,
"interval_hours": 2
}
},
"update_servers": {
"servers_for_offsite_devices": [
"http://updates2.cdc.carbonblack.io/update2"
],
"servers_for_onsite_devices": [
{
"preferred": true,
"server": "http://updates2.cdc.carbonblack.io/update2"
}
],
"servers_override": []
}
},
"directory_action_rules": [
{
"file_upload": false,
"path": "",
"protection": false
}
],
"is_system": false,
"org_key": "dummy_org_key",
"position": 108,
"rapid_configs": [
{
"description": "Turns on XDR network data collection at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "XDR",
"parameters": {
"enable_network_data_collection": true
}
},
{
"description": "Turns on Windows authentication events at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "Authentication Events",
"parameters": {
"enable_auth_events": false
}
},
{
"description": "Manages sensor settings specific to endpoint standard product",
"id": "dummy_id",
"inherited_from": "",
"name": "Endpoint standard sensor settings at policy scope",
"parameters": {
"inline_blocking_mode": "disabled"
}
},
{
"category": "data_collection",
"description": "Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Prevalent Module Exclusions",
"parameters": {
"enable_prevalent_module_event_collection": false
}
}
],
"rules": [],
"sensor_configs": [
{
"category": "sensor_settings",
"description": "Manages sensor settings specific to endpoint standard product",
"id": "dummy_id",
"inherited_from": "",
"name": "Endpoint standard sensor settings at policy scope",
"parameters": {
"inline_blocking_mode": "disabled"
}
}
],
"sensor_settings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "LEARNING_MODE",
"value": "0"
},
{
"name": "ALLOW_INLINE_BLOCKING",
"value": "true"
}
],
"update_time": 1720539000191
},
"priorityLevel": "MEDIUM"
}
}
}
Human Readable Output
Policy created successfully
Id Description Name Priority Level Is System 170044 aaaaaaaa test4 MEDIUM false
cbd-update-policy
Update an existing policy on the CB Defense backend.
Base Command
cbd-update-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A description of the policy. Can be multiple lines. | Optional |
| name | A unique one-line name for the policy. | Optional |
| priorityLevel | The priority score associated with sensors assigned to this policy. Possible values: “MISSION_CRITICAL”, “HIGH”, “MEDIUM”, and “LOW”. | Optional |
| id | The policy ID to update. | Required |
| policy | The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy’s fields with the set-policy command, and pass the edited object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VDI. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VM workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates if Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates if on-access scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of on-access scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates if on-demand scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile for on-demand scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates if on-demand scanning of CD/DVD is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates if on-demand scanning of USB devices is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates if a recovery scan is scheduled if the previous scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates if signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The servers used for offsite devices for updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates if the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates if server overrides are enabled for updates. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates if file upload is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The path for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates if protection is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates if the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rapid_configs.description | String | A description of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.id | String | The ID of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from | String | Indicates the source from which the rapid configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rapid_configs.name | String | The name of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection | Boolean | Indicates if network data collection is enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events | Boolean | Indicates if authentication events are enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode | String | The inline blocking mode for rapid configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The ID of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | Indicates the source from which the rule configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates if UBS opt-in is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates if prevalent module event collection is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The ID of the rules. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates if the rules are required. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified in the rules. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The ID of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | Indicates the source from which the sensor configurations are inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode for sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor settings. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor settings. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The time when the policy was last updated. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
Command example
!cbd-update-policy id=80947 policy="{\"name\": \"AWN BAS\", \"description\": \"aaaaaaaa\",\"org_key\": \"7DESJ9GN\", \"priority_level\": \"MEDIUM\", \"rules\": [], \"sensor_settings\": [{\"name\": \"ALLOW_UNINSTALL\", \"value\": \"true\"}]}"
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "aaaaaaaa",
"id": "dummy_id",
"name": "AWN BAS",
"policy": {
"auto_deregister_inactive_vdi_interval_ms": 0,
"auto_deregister_inactive_vm_workloads_interval_ms": 0,
"av_settings": {
"avira_protection_cloud": {
"enabled": false,
"max_exe_delay": 45,
"max_file_size": 4,
"risk_level": 4
},
"on_access_scan": {
"enabled": true,
"mode": "AGGRESSIVE"
},
"on_demand_scan": {
"enabled": true,
"profile": "NORMAL",
"scan_cd_dvd": "AUTOSCAN",
"scan_usb": "AUTOSCAN",
"schedule": {
"range_hours": 0,
"recovery_scan_if_missed": true,
"start_hour": 0
}
},
"signature_update": {
"enabled": true,
"schedule": {
"full_interval_hours": 0,
"initial_random_delay_hours": 4,
"interval_hours": 4
}
},
"update_servers": {
"servers_for_offsite_devices": [
"http://updates2.cdc.carbonblack.io/update2"
],
"servers_for_onsite_devices": [
{
"preferred": false,
"server": "http://updates2.cdc.carbonblack.io/update2"
}
],
"servers_override": []
}
},
"directory_action_rules": [
{
"file_upload": false,
"path": "",
"protection": false
}
],
"is_system": false,
"org_key": "dummy_org_key",
"position": 1,
"rapid_configs": [
{
"description": "Turns on XDR network data collection at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "XDR",
"parameters": {
"enable_network_data_collection": true
}
},
{
"description": "Addresses common TTPs/behaviors that threat actors use to avoid detection such as uninstalling or disabling security software, obfuscating or encrypting data/scripts and abusing trusted processes to hide and disguise their malicious activity.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Defense Evasion",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"description": "Addresses common TTPs/behaviors that threat actors use to retain access to systems across restarts, changed credentials, and other interruptions that could cut off their access.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Persistence",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"description": "Allows customers to exclude specific processes and process events from reporting to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting and Sensor Operation Exclusions",
"parameters": {}
},
{
"description": "Allows customers to exclude specific processes from reporting events to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting Exclusions",
"parameters": {}
},
{
"description": "These are the Host based Firewall Rules which will be executed by the sensor. The Definition will be part of Main Policies.",
"id": "dummy_id",
"inherited_from": "",
"name": "Host Based Firewall",
"parameters": {
"default_rule": {
"action": "ALLOW",
"default_rule_access_check_guid": "dummy_default_rule_access_check_guid",
"default_rule_inbound_event_check_guid": "dummy_default_rule_inbound_event_check_guid",
"default_rule_outbound_event_check_guid": "dummy_default_rule_outbound_event_check_guid"
},
"enable_host_based_firewall": true,
"rule_groups": [
{
"description": "C&C used by SocGholish",
"name": "Block C&C Traffic",
"rules": [
{
"action": "BLOCK_ALERT",
"application_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"direction": "OUT",
"enabled": true,
"local_ip_address": "*",
"local_port_ranges": "*",
"name": "SocGholish 2024-01-03",
"network_profile": [
"PUBLIC",
"PRIVATE",
"DOMAIN"
],
"protocol": "TCP",
"remote_ip_address": "1.1.1.1/22",
"remote_port_ranges": "443",
"rule_access_check_guid": "dummy_rule_access_check_guid",
"rule_inbound_event_check_guid": "dummy_rule_inbound_event_check_guid",
"rule_outbound_event_check_guid": "dummy_rule_outbound_event_check_guid",
"test_mode": false,
"threat_score": 8
}
],
"ruleset_id": "dummy_ruleset_id"
}
]
}
},
{
"description": "Enterprise EDR Event Collection",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Enterprise EDR Event Collection",
"parameters": {
"ubs_opt_in": true
}
},
{
"description": "Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Prevalent Module Exclusions",
"parameters": {
"enable_prevalent_module_event_collection": false
}
}
],
"rule_configs": [
{
"category": "data_collection",
"description": "Turns on XDR network data collection at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "XDR",
"parameters": {
"enable_network_data_collection": true
}
},
{
"category": "core_prevention",
"description": "Addresses common TTPs/behaviors that threat actors use to retain access to systems across restarts, changed credentials, and other interruptions that could cut off their access.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Persistence",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes and process events from reporting to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting and Sensor Operation Exclusions",
"parameters": {}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes from reporting events to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting Exclusions",
"parameters": {}
},
{
"category": "host_based_firewall",
"description": "These are the Host based Firewall Rules which will be executed by the sensor. The Definition will be part of Main Policies.",
"id": "dummy_id",
"inherited_from": "",
"name": "Host Based Firewall",
"parameters": {
"default_rule": {
"action": "ALLOW",
"default_rule_access_check_guid": "dummy_default_rule_access_check_guid",
"default_rule_inbound_event_check_guid": "dummy_default_rule_inbound_event_check_guid",
"default_rule_outbound_event_check_guid": "dummy_default_rule_outbound_event_check_guid"
},
"enable_host_based_firewall": true,
"rule_groups": [
{
"description": "C&C used by SocGholish",
"name": "Block C&C Traffic",
"rules": [
{
"action": "BLOCK_ALERT",
"application_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"direction": "OUT",
"enabled": true,
"local_ip_address": "*",
"local_port_ranges": "*",
"name": "SocGholish 2024-01-03",
"network_profile": [
"PUBLIC",
"PRIVATE",
"DOMAIN"
],
"protocol": "TCP",
"remote_ip_address": "1.1.1.1/22",
"remote_port_ranges": "443",
"rule_access_check_guid": "dummy_rule_access_check_guid",
"rule_inbound_event_check_guid": "dummy_rule_inbound_event_check_guid",
"rule_outbound_event_check_guid": "dummy_rule_outbound_event_check_guid",
"test_mode": false,
"threat_score": 8
}
],
"ruleset_id": "dummy_ruleset_id"
}
]
}
},
{
"category": "data_collection",
"description": "Enterprise EDR Event Collection",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Enterprise EDR Event Collection",
"parameters": {
"ubs_opt_in": true
}
},
{
"category": "data_collection",
"description": "Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Prevalent Module Exclusions",
"parameters": {
"enable_prevalent_module_event_collection": false
}
}
],
"rules": [],
"sensor_configs": [
{
"category": "sensor_settings",
"description": "Manages sensor settings specific to endpoint standard product",
"id": "dummy_id",
"inherited_from": "",
"name": "Endpoint standard sensor settings at policy scope",
"parameters": {
"inline_blocking_mode": "disabled"
}
}
],
"sensor_settings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "ALLOW_UPLOADS",
"value": "false"
},
{
"name": "SHOW_UI",
"value": "true"
},
{
"name": "LEARNING_MODE",
"value": "0"
},
{
"name": "ALLOW_INLINE_BLOCKING",
"value": "true"
}
],
"update_time": 1720539005619
},
"priorityLevel": "MEDIUM"
}
}
}
Human Readable Output
Policy with ID: 80947 updated successfully
Id Description Name Priority Level Is System 80947 aaaaaaaa AWN BAS MEDIUM false
cbd-set-policy
Set existing policy’s fields on the CB Defense backend.
Base Command
cbd-set-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policy | The policy ID to set. | Required |
| keyValue | The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy’s fields with the set-policy command, and pass the edited object. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VDI. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VM workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates if Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates if on-access scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of on-access scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates if on-demand scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile for on-demand scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates if on-demand scanning of CD/DVD is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates if on-demand scanning of USB devices is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates if a recovery scan is scheduled if the previous scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates if signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The servers used for offsite devices for updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates if the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates if server overrides are enabled for updates. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates if file upload is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The path for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates if protection is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates if the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rapid_configs.description | String | A description of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.id | String | The ID of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from | String | Indicates the source from which the rapid configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rapid_configs.name | String | The name of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection | Boolean | Indicates if network data collection is enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events | Boolean | Indicates if authentication events are enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode | String | The inline blocking mode for rapid configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The ID of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | Indicates the source from which the rule configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates if UBS opt-in is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates if prevalent module event collection is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The ID of the rules. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates if the rules are required. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified in the rules. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The ID of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | Indicates the source from which the sensor configurations are inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode for sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor settings. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor settings. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The time when the policy was last updated. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
cbd-delete-policy
Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.
Base Command
cbd-delete-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
Context Output
There is no context output for this command.
Command example
!cbd-delete-policy policyId=169977
Human Readable Output
Policy with ID 169977 was deleted successfully
cbd-add-rule-to-policy
Adds a new rule to an existing policy. Note: System policies cannot be modified.
Base Command
cbd-add-rule-to-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| action | Rule action. Possible values: “TERMINATE”, “IGNORE”, “TERMINATE_THREAD”, “ALLOW”, “DENY, and “TERMINATE_PROCESS”. | Required |
| operation | Rule operation. Possible values: BYPASS_ALL, BYPASS_API, INVOKE_SCRIPT, INVOKE_SYSAPP, POL_INVOKE_NOT_TRUSTED, INVOKE_CMD_INTERPRETER, RANSOM, NETWORK, CODE_INJECTION, PROCESS_ISOLATION, MEMORY_SCRAPE, RUN_INMEMORY_CODE, ESCALATE, RUN. | Required |
| required | Whether the rule is required. Possible values: true, false. | Required |
| type | Application type. Possible values: “REPUTATION”, “SIGNED_BY”, and “NAME_PATH”. | Required |
| value | Application value. Possible values: ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Required |
| policyId | The policy ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VDI. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VM workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates if Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates if on-access scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of on-access scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates if on-demand scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile for on-demand scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates if on-demand scanning of CD/DVD is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates if on-demand scanning of USB devices is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates if a recovery scan is scheduled if the previous scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates if signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The servers used for offsite devices for updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates if the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates if server overrides are enabled for updates. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates if file upload is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The path for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates if protection is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates if the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rapid_configs.description | String | A description of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.id | String | The ID of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from | String | Indicates the source from which the rapid configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rapid_configs.name | String | The name of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection | Boolean | Indicates if network data collection is enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events | Boolean | Indicates if authentication events are enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode | String | The inline blocking mode for rapid configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The ID of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | Indicates the source from which the rule configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates if UBS opt-in is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates if prevalent module event collection is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The ID of the rules. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates if the rules are required. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified in the rules. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The ID of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | Indicates the source from which the sensor configurations are inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode for sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor settings. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor settings. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The time when the policy was last updated. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
cbd-update-rule-in-policy
Updates an existing rule with a new rule. Note: System policies cannot be modified.
Base Command
cbd-update-rule-in-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| action | Rule action. Possible values: “TERMINATE”, “IGNORE”, “TERMINATE_THREAD”, “ALLOW”, “DENY”, and “TERMINATE_PROCESS”. | Required |
| operation | Rule operation. Possible values: BYPASS_ALL, BYPASS_API, INVOKE_SCRIPT, INVOKE_SYSAPP, POL_INVOKE_NOT_TRUSTED, INVOKE_CMD_INTERPRETER, RANSOM, NETWORK, CODE_INJECTION, PROCESS_ISOLATION, MEMORY_SCRAPE, RUN_INMEMORY_CODE, ESCALATE, RUN. | Required |
| required | Whether the rule is required. Possible values: true, false. | Required |
| id | Rule ID. | Required |
| type | Application type. Possible values: “REPUTATION”, “SIGNED_BY”, and “NAME_PATH”. | Required |
| value | Application value. Possible values: ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST. | Required |
| policyId | The policy ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Policy.description | String | A brief summary or description of the policy. |
| CarbonBlackDefense.Policy.id | Number | The unique policy ID. |
| CarbonBlackDefense.Policy.name | String | The name of the policy. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VDI. |
| CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms | Number | The interval in milliseconds for auto-deregistering inactive VM workloads. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled | Boolean | Indicates if Avira Protection Cloud is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay | Number | The maximum execution delay for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size | Number | The maximum file size for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level | Number | The risk level for Avira Protection Cloud. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled | Boolean | Indicates if on-access scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode | String | The mode of on-access scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled | Boolean | Indicates if on-demand scanning is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile | String | The profile for on-demand scanning. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd | String | Indicates if on-demand scanning of CD/DVD is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb | String | Indicates if on-demand scanning of USB devices is enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours | Number | The range of hours for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed | Boolean | Indicates if a recovery scan is scheduled if the previous scan is missed. |
| CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour | Number | The start hour for the on-demand scan schedule. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled | Boolean | Indicates if signature updates are enabled. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours | Number | The full interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours | Number | The initial random delay in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours | Number | The interval in hours for signature update scheduling. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices | String | The servers used for offsite devices for updates. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred | Boolean | Indicates if the server is preferred for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server | String | The server used for onsite devices. |
| CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override | Unknown | Indicates if server overrides are enabled for updates. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload | Boolean | Indicates if file upload is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.path | String | The path for directory action rules. |
| CarbonBlackDefense.Policy.policy.directory_action_rules.protection | Boolean | Indicates if protection is enabled for directory action rules. |
| CarbonBlackDefense.Policy.policy.is_system | Boolean | Indicates if the policy is a system policy. |
| CarbonBlackDefense.Policy.policy.org_key | String | The organization key associated with the policy. |
| CarbonBlackDefense.Policy.policy.position | Number | The position of the policy in the list of policies. |
| CarbonBlackDefense.Policy.policy.rapid_configs.description | String | A description of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.id | String | The ID of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from | String | Indicates the source from which the rapid configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rapid_configs.name | String | The name of the rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection | Boolean | Indicates if network data collection is enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events | Boolean | Indicates if authentication events are enabled in rapid configurations. |
| CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode | String | The inline blocking mode for rapid configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.category | String | The category of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.description | String | A description of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.id | String | The ID of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.inherited_from | String | Indicates the source from which the rule configurations are inherited. |
| CarbonBlackDefense.Policy.policy.rule_configs.name | String | The name of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters | Unknown | The parameters of the rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in | Boolean | Indicates if UBS opt-in is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection | Boolean | Indicates if prevalent module event collection is enabled in rule configurations. |
| CarbonBlackDefense.Policy.policy.rules.id | Number | The ID of the rules. |
| CarbonBlackDefense.Policy.policy.rules.required | Boolean | Indicates if the rules are required. |
| CarbonBlackDefense.Policy.policy.rules.action | String | The action specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.type | String | The type of application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.application.value | String | The value of the application specified in the rules. |
| CarbonBlackDefense.Policy.policy.rules.operation | String | The operation specified in the rules. |
| CarbonBlackDefense.Policy.policy.sensor_configs.category | String | The category of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.description | String | A description of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.id | String | The ID of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from | String | Indicates the source from which the sensor configurations are inherited. |
| CarbonBlackDefense.Policy.policy.sensor_configs.name | String | The name of the sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode | String | The inline blocking mode for sensor configurations. |
| CarbonBlackDefense.Policy.policy.sensor_settings.name | String | The name of the sensor settings. |
| CarbonBlackDefense.Policy.policy.sensor_settings.value | String | The value of the sensor settings. |
| CarbonBlackDefense.Policy.policy.update_time | Date | The time when the policy was last updated. |
| CarbonBlackDefense.Policy.priorityLevel | String | The priority level of the policy. |
Command example
!cbd-update-rule-in-policy action=IGNORE type=REPUTATION value=COMMON_WHITE_LIST operation=MEMORY_SCRAPE required=true policyId=12345 id=47
Context Example
{
"CarbonBlackDefense": {
"Policy": {
"description": "aaaaaaaa",
"id": "dummy_id",
"name": "tesssttsss",
"policy": {
"auto_deregister_inactive_vdi_interval_ms": 0,
"auto_deregister_inactive_vm_workloads_interval_ms": 0,
"av_settings": {
"avira_protection_cloud": {
"enabled": false,
"max_exe_delay": 45,
"max_file_size": 4,
"risk_level": 4
},
"on_access_scan": {
"enabled": true,
"mode": "NORMAL"
},
"on_demand_scan": {
"enabled": true,
"profile": "NORMAL",
"scan_cd_dvd": "AUTOSCAN",
"scan_usb": "AUTOSCAN",
"schedule": {
"range_hours": 0,
"recovery_scan_if_missed": true,
"start_hour": 0
}
},
"signature_update": {
"enabled": false,
"schedule": {
"full_interval_hours": 0,
"initial_random_delay_hours": 4,
"interval_hours": 2
}
},
"update_servers": {
"servers_for_offsite_devices": [
"http://updates2.cdc.carbonblack.io/update2"
],
"servers_for_onsite_devices": [
{
"preferred": true,
"server": "http://updates2.cdc.carbonblack.io/update2"
}
],
"servers_override": []
}
},
"directory_action_rules": [
{
"file_upload": false,
"path": "",
"protection": false
}
],
"is_system": false,
"org_key": "dummy_org_key",
"position": 105,
"rule_configs": [
{
"category": "data_collection",
"description": "Turns on XDR network data collection at the sensor",
"id": "dummy_id",
"inherited_from": "",
"name": "XDR",
"parameters": {
"enable_network_data_collection": true
}
},
{
"category": "core_prevention",
"description": "Addresses common TTPs/behaviors that threat actors use to retain access to systems across restarts, changed credentials, and other interruptions that could cut off their access.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Persistence",
"parameters": {
"WindowsAssignmentMode": "BLOCK"
}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes and process events from reporting to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting and Sensor Operation Exclusions",
"parameters": {}
},
{
"category": "bypass",
"description": "Allows customers to exclude specific processes from reporting events to CBC",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Event Reporting Exclusions",
"parameters": {}
},
{
"category": "data_collection",
"description": "Enterprise EDR Event Collection",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Enterprise EDR Event Collection",
"parameters": {
"ubs_opt_in": true
}
},
{
"category": "data_collection",
"description": "Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.",
"id": "dummy_id",
"inherited_from": "psc:region",
"name": "Prevalent Module Exclusions",
"parameters": {
"enable_prevalent_module_event_collection": false
}
}
],
"rules": [
{
"action": "IGNORE",
"application": {
"type": "REPUTATION",
"value": "COMMON_WHITE_LIST"
},
"id": "dummy_id",
"operation": "MEMORY_SCRAPE",
"required": true
}
],
"sensor_configs": [
{
"category": "sensor_settings",
"description": "Manages sensor settings specific to endpoint standard product",
"id": "dummy_id",
"inherited_from": "",
"name": "Endpoint standard sensor settings at policy scope",
"parameters": {
"inline_blocking_mode": "disabled"
}
}
],
"sensor_settings": [
{
"name": "ALLOW_UNINSTALL",
"value": "true"
},
{
"name": "QUEUE_SIZE",
"value": "100"
},
{
"name": "LEARNING_MODE",
"value": "0"
},
{
"name": "ALLOW_INLINE_BLOCKING",
"value": "true"
}
],
"update_time": 1720539019776
},
"priorityLevel": "MEDIUM"
}
}
}
Human Readable Output
Carbon Black Defense Policy
Id Name Priority Level Is System Description 169994 tesssttsss MEDIUM false aaaaaaaa
cbd-delete-rule-from-policy
Removes a rule from an existing policy. Note: System policies cannot be modified.
Base Command
cbd-delete-rule-from-policy
Input
| Argument Name | Description | Required |
|---|---|---|
| policyId | The policy ID. | Required |
| ruleId | The rule ID. | Required |
Context Output
There is no context output for this command.
Command example
!cbd-delete-rule-from-policy ruleId=47 policyId=169994
Human Readable Output
Rule id 47 was successfully deleted from policy id 169994
cbd-find-processes
Creates a process search job and retrieves the search results. At least one of the arguments (not including: rows, start, and time_range) is required.
Base Command
cbd-find-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | When set to “no”, the function will not use polling and will return the process job ID. Possible values: yes, no. Default is yes. | Optional |
| job_id | The unique process search job ID. This ID is used to retrieve the results of the process search initiated by the Carbon Black Cloud. If not provided, a new search job will be created based on the other provided arguments. | Optional |
| alert_category | The Carbon Black Cloud classification for events tagged to an alert. Possible values: “THREAT” and “OBSERVED”. | Optional |
| device_external_ip | The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. | Optional |
| device_id | The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. | Optional |
| device_internal_ip | The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. | Optional |
| device_name | The hostname of the endpoint recorded by the sensor when last initialized. | Optional |
| device_os | The operating system of the endpoint. Possible values: “WINDOWS”, “MAC”, “LINUX”. | Optional |
| device_timestamp | The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z. | Optional |
| event_type | The type of enriched event observed. Possible value: “filemod”, “netconn”, “regmod”, “modload”, “crossproc”, “childproc”, “scriptload”, and “fileless_scriptload”. Possible values : filemod, netconn, regmod, modload, crossproc, childproc, scriptload, fileless_scriptload. | Optional |
| parent_name | The file system path of the parent process binary. | Optional |
| parent_reputation | The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. | Optional |
| process_cmdline | The command line executed by the actor process. | Optional |
| process_guid | The unique process ID for the the actor process. | Optional |
| hash | Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). | Optional |
| process_name | The file system path of the actor process binary. | Optional |
| process_pid | The process ID assigned by the operating system. This can be multi-valued for fork() or exec() process operations on Linux and macOS. | Optional |
| process_reputation | The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. | Optional |
| process_start_time | The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts. | Optional |
| process_terminated | Whether the process has terminated. Always “false” for enriched events (process termination not recorded). Possible values: true, false. | Optional |
| process_username | The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). |
Optional |
| sensor_action | The action performed by the sensor on the process. Possible values: “TERMINATE”, “DENY”, and “SUSPEND”. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of rows to request. | Optional |
| start | The first row to use for pagination. | Optional |
| time_range | The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {“end”: “2020-01-21T18:34:04Z”, “start”: “2020-01-18T18:34:04Z”, “window”: “-2w”}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp. | Optional |
| interval_in_seconds | Used for polling. | Optional |
| time_out | Used for polling. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Process.job_id | String | The process job id when polling set to false. |
| CarbonBlackDefense.Process.Results.backend_timestamp | Date | The timestamp when the process data was collected from the backend. |
| CarbonBlackDefense.Process.Results.childproc_count | Number | The number of child processes spawned by the process. |
| CarbonBlackDefense.Process.Results.crossproc_count | Number | The number of cross-process interactions involving the process. |
| CarbonBlackDefense.Process.Results.device_id | Number | The unique ID of the device where the process is running. |
| CarbonBlackDefense.Process.Results.device_name | String | The name of the device where the process is running. |
| CarbonBlackDefense.Process.Results.device_policy_id | Number | The policy ID associated with the device. |
| CarbonBlackDefense.Process.Results.device_timestamp | Date | The timestamp when the process data was collected from the device. |
| CarbonBlackDefense.Process.Results.filemod_count | Number | The number of file modifications made by the process. |
| CarbonBlackDefense.Process.Results.index_class | String | The classification of the process based on indexing. |
| CarbonBlackDefense.Process.Results.modload_count | Number | The number of modules loaded by the process. |
| CarbonBlackDefense.Process.Results.netconn_count | Number | The number of network connections established by the process. |
| CarbonBlackDefense.Process.Results.org_id | String | The organization ID associated with the process. |
| CarbonBlackDefense.Process.Results.parent_guid | String | The GUID of the parent process. |
| CarbonBlackDefense.Process.Results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackDefense.Process.Results.partition_id | Number | The partition ID associated with the process. |
| CarbonBlackDefense.Process.Results.process_guid | String | The GUID of the process. |
| CarbonBlackDefense.Process.Results.process_hash | String | The hash of the process. |
| CarbonBlackDefense.Process.Results.process_name | String | The name of the process. |
| CarbonBlackDefense.Process.Results.process_pid | Number | The PID of the process. |
| CarbonBlackDefense.Process.Results.process_username | String | The username under which the process is running. |
| CarbonBlackDefense.Process.Results.regmod_count | Number | The number of registry modifications made by the process. |
| CarbonBlackDefense.Process.Results.scriptload_count | Number | The number of scripts loaded by the process. |
Command example
!cbd-find-processes device_id=5217044
Context Example
{
"CarbonBlackDefense": {
"Process": {
"Results": [
{
"alert_category": [
"THREAT"
],
"alert_id": [
"49becb5d-8cca-4b39-b7f4-d94401533dab",
"6038e242-2c44-470c-92e3-bf3a0c32dc26",
"a7056445-388b-46d8-9d8e-3885bfe28fc0"
],
"backend_timestamp": "2024-07-11T14:51:29.069Z",
"childproc_count": 1,
"crossproc_count": 7,
"device_group_id": 0,
"device_id": 12345,
"device_name": "r7betalab\\r7betalab-arw04",
"device_policy_id": 80947,
"device_timestamp": "2024-07-11T14:44:11.754Z",
"filemod_count": 11,
"ingress_time": 1720709467661,
"modload_count": 40,
"netconn_count": 0,
"org_id": "7DESJ9GN",
"parent_guid": "dummy_parent_guid",
"parent_pid": 4380,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
],
"process_name": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"process_pid": [
2192
],
"process_username": [
"R7BETALAB\\svc_idr"
],
"regmod_count": 4,
"scriptload_count": 1,
"watchlist_hit": []
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-11T14:34:13.616Z",
"childproc_count": 0,
"crossproc_count": 0,
"device_group_id": 0,
"device_id": 12345,
"device_name": "cb-markotest",
"device_policy_id": 6525,
"device_timestamp": "2024-07-11T14:30:39.203Z",
"filemod_count": 0,
"ingress_time": 1720708414089,
"modload_count": 0,
"netconn_count": 1,
"org_id": "7DESJ9GN",
"parent_guid": "dummy_parent_guid",
"parent_pid": 688,
"process_guid": "dummy_process_guid",
"process_hash": [],
"process_name": "c:\\windows\\system32\\svchost.exe",
"process_pid": [
2264
],
"process_username": [
"NT AUTHORITY\\NETWORK SERVICE"
],
"regmod_count": 0,
"scriptload_count": 0,
"watchlist_hit": [
"abcd123"
]
}
]
}
}
}
Human Readable Output
The Results For The Process Search
Device Id Device Name Process Name Device Policy Id 1234 r7betalab\r7betalab-arw04 c:\windows\system32\windowspowershell\v1.0\powershell.exe 80947 1111 cb-markotest c:\windows\system32\svchost.exe 6525
cbd-find-observation-details
Fetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion.
Base Command
cbd-find-observation-details
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | When set to false, the function will not use polling and will return the process job ID. Possible values: yes, no. Default is True. | Optional |
| job_id | The ID of the job to retrieve the details. This is used internally for polling. | Optional |
| alert_id | The ID of the alert to retrieve the observation details. Must be specified alone. | Optional |
| observation_ids | A list of observation IDs to retrieve the details. Must be specified alone. | Optional |
| process_hash | The hash of the process to search for. Can be combined with rows, and with device_id or count_unique_devices, but not both. | Optional |
| device_id | The ID of the device to filter the observations. Must be combined with process_hash. Cannot be combined with alert_id, observation_ids, count_unique_devices. | Optional |
| count_unique_devices | A boolean indicating whether to count unique devices executing the process hash. Must be combined with process_hash. Cannot be combined with alert_id, observation_ids, device_id. | Optional |
| rows | The maximum number of rows to return, up to 10,000. Can only be combined with process_hash. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.EventDetails.job_id | String | The process job id when polling set to false. |
| CarbonBlackDefense.EventDetails.Results.alert_category | String | The category of the alert associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.alert_id | String | The unique ID of the alert associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.backend_timestamp | Date | The timestamp when the observation data was collected from the backend. |
| CarbonBlackDefense.EventDetails.Results.childproc_count | Number | The number of child processes spawned by the observed process. |
| CarbonBlackDefense.EventDetails.Results.crossproc_count | Number | The number of cross-process interactions involving the observed process. |
| CarbonBlackDefense.EventDetails.Results.device_external_ip | String | The external IP address of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_group_id | Number | The group ID associated with the device. |
| CarbonBlackDefense.EventDetails.Results.device_id | Number | The unique ID of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_installed_by | String | The user or process that installed the device. |
| CarbonBlackDefense.EventDetails.Results.device_internal_ip | String | The internal IP address of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_location | String | The physical or network location of the device. |
| CarbonBlackDefense.EventDetails.Results.device_name | String | The name of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_os | String | The operating system of the device. |
| CarbonBlackDefense.EventDetails.Results.device_os_version | String | The version of the operating system of the device. |
| CarbonBlackDefense.EventDetails.Results.device_policy | String | The policy applied to the device. |
| CarbonBlackDefense.EventDetails.Results.device_policy_id | Number | The unique ID of the policy applied to the device. |
| CarbonBlackDefense.EventDetails.Results.device_sensor_version | String | The version of the sensor installed on the device. |
| CarbonBlackDefense.EventDetails.Results.device_target_priority | String | The priority level of the device as a target. |
| CarbonBlackDefense.EventDetails.Results.device_timestamp | Date | The timestamp when the observation was recorded on the device. |
| CarbonBlackDefense.EventDetails.Results.document_guid | String | The GUID of the document associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.enriched | Boolean | Indicates whether the observation data has been enriched with additional information. |
| CarbonBlackDefense.EventDetails.Results.enriched_event_type | String | The type of event after enrichment. |
| CarbonBlackDefense.EventDetails.Results.event_threat_score | Number | The threat score associated with the event. |
| CarbonBlackDefense.EventDetails.Results.filemod_count | Number | The number of file modifications made by the observed process. |
| CarbonBlackDefense.EventDetails.Results.ingress_time | Date | The time when the observation data was ingested into the system. |
| CarbonBlackDefense.EventDetails.Results.legacy | Boolean | Indicates whether the observation is from a legacy system or data source. |
| CarbonBlackDefense.EventDetails.Results.modload_count | Number | The number of modules loaded by the observed process. |
| CarbonBlackDefense.EventDetails.Results.netconn_count | Number | The number of network connections established by the observed process. |
| CarbonBlackDefense.EventDetails.Results.observation_description | String | A description of the observation. |
| CarbonBlackDefense.EventDetails.Results.observation_id | String | The unique observation ID. |
| CarbonBlackDefense.EventDetails.Results.observation_type | String | The type of observation. |
| CarbonBlackDefense.EventDetails.Results.org_id | String | The organization ID associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.parent_cmdline | String | The command line arguments of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_cmdline_length | Number | The length of the command line arguments of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_effective_reputation | String | The effective reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_effective_reputation_source | String | The source of the effective reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_guid | String | The GUID of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_hash | String | The hash of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_name | String | The name of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_publisher | String | The publisher of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_publisher_state | String | The state of the publisher of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_reputation | String | The reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.process_cmdline | String | The command line arguments of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_cmdline_length | Number | The length of the command line arguments of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_company_name | String | The company name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_effective_reputation | String | The effective reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_effective_reputation_source | String | The source of the effective reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_elevated | Boolean | Indicates whether the observed process is running with elevated privileges. |
| CarbonBlackDefense.EventDetails.Results.process_file_description | String | The description of the observed process file. |
| CarbonBlackDefense.EventDetails.Results.process_guid | String | The GUID of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_hash | String | The hash of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_integrity_level | String | The integrity level of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_internal_name | String | The internal name of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_name | String | The name of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_original_filename | String | The original filename of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_pid | Number | The PID of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_privileges | String | The privileges associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_product_name | String | The product name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_product_version | String | The product version associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_publisher | String | The publisher of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_publisher_state | String | The state of the publisher of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_reputation | String | The reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_service_name | String | The service name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_sha256 | unknown | The SHA-256 hash. |
Command example
!cbd-find-observation-details process_hash=abc1234
Context Example
{
"CarbonBlackDefense": {
"EventDetails": {
"Results": {
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-04-17T01:52:29.056Z",
"blocked_effective_reputation": "TRUSTED_WHITE_LIST",
"blocked_hash": [
"dummy_blocked_hash"
],
"blocked_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"childproc_cmdline": "\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow() ",
"childproc_cmdline_length": 124,
"childproc_effective_reputation": "TRUSTED_WHITE_LIST",
"childproc_effective_reputation_source": "CLOUD",
"childproc_guid": "dummy_childproc_guid",
"childproc_hash": [
"dummy_chidproc_hash"
],
"childproc_issuer": [
"Microsoft Windows Production PCA 2011"
],
"childproc_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"childproc_pid": 1020,
"childproc_publisher": [
"Microsoft Windows"
],
"childproc_publisher_state": [
"FILE_SIGNATURE_STATE_VERIFIED",
"FILE_SIGNATURE_STATE_SIGNED"
],
"childproc_reputation": "TRUSTED_WHITE_LIST",
"childproc_username": "NT AUTHORITY\SYSTEM",
"device_external_ip": "1.1.1.1",
"device_group_id": 0,
"device_id": 12345,
"device_installed_by": "user@example.com",
"device_internal_ip": "1.1.1.1",
"device_location": "OFFSITE",
"device_name": "corp\wsamzn-lshqdrdc",
"device_os": "WINDOWS",
"device_os_version": "Windows Server 2019 x64",
"device_policy": "tines-policy",
"device_policy_id": 1234,
"device_sensor_version": "1.1.1.1",
"device_target_priority": "LOW",
"device_timestamp": "2024-04-17T01:50:54.057Z",
"document_guid": "dummy_document_guid",
"enriched": true,
"enriched_event_type": "CREATE_PROCESS",
"event_attack_stage": [
"INSTALL_RUN"
],
"event_description": "The script \"<share><link hash=\"dummy_hash\">C:\program files\amazon\skylight\scripts\windows_update_status.ps1</link></share>\" invoked the application \"<share><link hash=\"dummy_hash\">C:\windows\system32\windowspowershell\v1.0\powershell.exe</link></share>\". The operation was <accent>blocked</accent> and the application <accent>terminated by Carbon Black</accent>.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1713318735609,
"legacy": true,
"observation_description": "The application windows_update_status.ps1 invoked another application (powershell.exe). A Deny Policy Action was applied.",
"observation_id": "dummy_observation_id",
"observation_type": "CB_ANALYTICS",
"org_id": "abc123",
"parent_effective_reputation": "LOCAL_WHITE",
"parent_effective_reputation_source": "PRE_EXISTING",
"parent_guid": "dummy_parent_guid",
"parent_hash": [
"dummy_parent_hash"
],
"parent_name": "c:\program files\amazon\skylight\skylightworkspaceconfigservice.exe",
"parent_pid": 1234,
"parent_reputation": "NOT_LISTED",
"parent_username": "NT AUTHORITY\SYSTEM",
"process_cmdline": [
"\"powershell.exe\" -NonInteractive -ExecutionPolicy AllSigned -File \"C:\Program files\Amazon\SkyLight\scripts\windows_update_status.ps1\" -scriptId windows_update_status.ps1 CheckStatus"
],
"process_cmdline_length": [
182
],
"process_effective_reputation": "ADAPTIVE_WHITE_LIST",
"process_effective_reputation_source": "CLOUD",
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
],
"process_loaded_script_hash": [
"dummy_process_loaded_script_hash"
],
"process_loaded_script_name": [
"c:\program files\amazon\skylight\scripts\windows_update_status.ps1"
],
"process_name": "c:\program files\amazon\skylight\scripts\windows_update_status.ps1",
"process_pid": [
1234
],
"process_reputation": "NOT_LISTED",
"process_sha256": "dummy_process_sha256",
"process_start_time": "2024-04-17T01:50:48.244Z",
"process_user_id": "S-1-5-18",
"process_username": [
"NT AUTHORITY\SYSTEM"
],
"sensor_action": [
"TERMINATE"
],
"ttp": [
"MITRE_T1059_CMD_LINE_OR_SCRIPT_INTER",
"POLICY_DENY",
"MITRE_T1059_001_POWERSHELL"
]
}
}
}
}
Human Readable Output
Defense Event Details Results
Observation Id Event Id Device Id Device External Ip Device Internal Ip Enriched Event Type dummy_observation_id dummy_event_id 1234 1.1.1.1 1.1.1.1 CREATE_PROCESS
cbd-find-observation
Fetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion.
Base Command
cbd-find-observation
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | When set to false, the function will not use polling and will return the process job ID. Possible values are: yes, no. Default is True. | Optional |
| job_id | The ID of the job to retrieve the observation. This is used internally for polling. | Optional |
| alert_category | The Carbon Black Cloud classification for events tagged to an alert. Possible values: “THREAT” and “OBSERVED”. | Optional |
| device_external_ip | The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. | Optional |
| device_id | The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. | Optional |
| device_internal_ip | The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. | Optional |
| device_name | The hostname of the endpoint recorded by the sensor when last initialized. | Optional |
| device_os | The operating system of the endpoint. Possible values: “WINDOWS”, “MAC”, “LINUX”. | Optional |
| device_timestamp | The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z. | Optional |
| event_type | The type of enriched event observed. Possible value: “filemod”, “netconn”, “regmod”, “modload”, “crossproc”, “childproc”, “scriptload”, and “fileless_scriptload”. Possible values: filemod, netconn, regmod, modload, crossproc, childproc, scriptload, fileless_scriptload. | Optional |
| parent_name | The file system path of the parent process binary. | Optional |
| parent_reputation | The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. | Optional |
| process_cmdline | The command line executed by the actor process. | Optional |
| process_guid | The unique process ID for the actor process. | Optional |
| hash | Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). | Optional |
| process_name | The file system path of the actor process binary. | Optional |
| process_pid | The process ID assigned by the operating system. This can be multi-valued for fork() or exec() process operations on Linux and macOS. | Optional |
| process_reputation | The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: “ADAPTIVE_WHITE_LIST”, “ADWARE”, “COMMON_WHITE_LIST”, “COMPANY_BLACK_LIST”, “COMPANY_WHITE_LIST”, “HEURISTIC”, “IGNORE”, “KNOWN_MALWARE”, “LOCAL_WHITE”, “NOT_LISTED”, “PUP”, “RESOLVING”, “SUSPECT_MALWARE”, and “TRUSTED_WHITE_LIST”. | Optional |
| process_start_time | The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts. | Optional |
| process_terminated | Whether the process has terminated. Possible values: “true” and “false”. Always “false” for enriched events (process termination not recorded). | Optional |
| process_username | The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). |
Optional |
| sensor_action | The action performed by the sensor on the process. Possible values: “TERMINATE”, “DENY”, and “SUSPEND”. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| rows | The number of rows to request. | Optional |
| start | The first row to use for pagination. | Optional |
| time_range | The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {“end”: “2020-01-21T18:34:04Z”, “start”: “2020-01-18T18:34:04Z”, “window”: “-2w”}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp. | Optional |
| interval_in_seconds | Used for polling. | Optional |
| time_out | Used for polling. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Events.job_id | String | The process job id when polling set to false. |
| CarbonBlackDefense.Events.Results.alert_category | String | Category of the alert associated with the event. |
| CarbonBlackDefense.Events.Results.alert_id | String | The unique alert ID. |
| CarbonBlackDefense.Events.Results.backend_timestamp | Date | Timestamp when the event was processed on the backend. |
| CarbonBlackDefense.Events.Results.childproc_count | Number | Number of child processes spawned by the process. |
| CarbonBlackDefense.Events.Results.crossproc_count | Number | Number of cross-process operations performed by the process. |
| CarbonBlackDefense.Events.Results.device_external_ip | String | External IP address of the device. |
| CarbonBlackDefense.Events.Results.device_group_id | Number | The device group ID. |
| CarbonBlackDefense.Events.Results.device_id | Number | The unique device ID. |
| CarbonBlackDefense.Events.Results.device_installed_by | String | User or entity that installed the device. |
| CarbonBlackDefense.Events.Results.device_internal_ip | String | Internal IP address of the device. |
| CarbonBlackDefense.Events.Results.device_location | String | Physical or network location of the device. |
| CarbonBlackDefense.Events.Results.device_name | String | Name of the device. |
| CarbonBlackDefense.Events.Results.device_os | String | Operating system running on the device. |
| CarbonBlackDefense.Events.Results.device_os_version | String | Version of the operating system running on the device. |
| CarbonBlackDefense.Events.Results.device_policy | String | Security policy applied to the device. |
| CarbonBlackDefense.Events.Results.device_policy_id | Number | The the security policy ID applied to the device. |
| CarbonBlackDefense.Events.Results.device_sensor_version | String | Version of the sensor installed on the device. |
| CarbonBlackDefense.Events.Results.device_target_priority | String | Priority of the device as a target. |
| CarbonBlackDefense.Events.Results.device_timestamp | Date | Timestamp of the event as recorded by the device. |
| CarbonBlackDefense.Events.Results.document_guid | String | The global unique ID for the document associated with the event. |
| CarbonBlackDefense.Events.Results.enriched | Boolean | Indicates whether the event data has been enriched. |
| CarbonBlackDefense.Events.Results.enriched_event_type | String | Type of the enriched event. |
| CarbonBlackDefense.Events.Results.event_threat_score | Number | Threat score assigned to the event. |
| CarbonBlackDefense.Events.Results.filemod_count | Number | Number of file modifications performed by the process. |
| CarbonBlackDefense.Events.Results.ingress_time | Date | Time when the event was ingested by the system. |
| CarbonBlackDefense.Events.Results.legacy | Boolean | Indicates whether the event is considered a legacy event. |
| CarbonBlackDefense.Events.Results.modload_count | Number | Number of modules loaded by the process. |
| CarbonBlackDefense.Events.Results.netconn_count | Number | Number of network connections established by the process. |
| CarbonBlackDefense.Events.Results.observation_description | String | Description of the observation associated with the event. |
| CarbonBlackDefense.Events.Results.observation_id | String | The unique observation ID. |
| CarbonBlackDefense.Events.Results.observation_type | String | Type of the observation associated with the event. |
| CarbonBlackDefense.Events.Results.org_id | String | The organization ID associated with the event. |
| CarbonBlackDefense.Events.Results.parent_cmdline | String | Command line used to execute the parent process. |
| CarbonBlackDefense.Events.Results.parent_cmdline_length | Number | Length of the command line used to execute the parent process. |
| CarbonBlackDefense.Events.Results.parent_effective_reputation | String | Effective reputation of the parent process. |
| CarbonBlackDefense.Events.Results.parent_effective_reputation_source | String | Source of the effective reputation of the parent process. |
| CarbonBlackDefense.Events.Results.parent_guid | String | The global unique ID for the parent process. |
| CarbonBlackDefense.Events.Results.parent_hash | String | Hash of the parent process. |
| CarbonBlackDefense.Events.Results.parent_name | String | Name of the parent process. |
| CarbonBlackDefense.Events.Results.parent_pid | Number | The parent process ID. |
| CarbonBlackDefense.Events.Results.parent_publisher | String | Publisher of the parent process. |
| CarbonBlackDefense.Events.Results.parent_publisher_state | String | Publisher state of the parent process. |
| CarbonBlackDefense.Events.Results.parent_reputation | String | Reputation of the parent process. |
| CarbonBlackDefense.Events.Results.process_cmdline | String | Command line used to execute the process. |
| CarbonBlackDefense.Events.Results.process_cmdline_length | Number | Length of the command line used to execute the process. |
| CarbonBlackDefense.Events.Results.process_company_name | String | Company name associated with the process. |
| CarbonBlackDefense.Events.Results.process_effective_reputation | String | Effective reputation of the process. |
| CarbonBlackDefense.Events.Results.process_effective_reputation_source | String | Source of the effective reputation of the process. |
| CarbonBlackDefense.Events.Results.process_elevated | Boolean | Indicates whether the process is running with elevated privileges. |
| CarbonBlackDefense.Events.Results.process_file_description | String | File description of the process. |
| CarbonBlackDefense.Events.Results.process_guid | String | The global unique process ID. |
| CarbonBlackDefense.Events.Results.process_hash | String | Hash of the process. |
| CarbonBlackDefense.Events.Results.process_integrity_level | String | Integrity level of the process. |
| CarbonBlackDefense.Events.Results.process_internal_name | String | Internal name of the process. |
| CarbonBlackDefense.Events.Results.process_name | String | Name of the process. |
| CarbonBlackDefense.Events.Results.process_original_filename | String | Original filename of the process. |
| CarbonBlackDefense.Events.Results.process_pid | Number | The process ID of the process. |
| CarbonBlackDefense.Events.Results.process_privileges | String | Privileges associated with the process. |
| CarbonBlackDefense.Events.Results.process_product_name | String | Product name associated with the process. |
| CarbonBlackDefense.Events.Results.process_product_version | String | Product version associated with the process. |
| CarbonBlackDefense.Events.Results.process_publisher | String | Publisher of the process. |
| CarbonBlackDefense.Events.Results.process_publisher_state | String | Publisher state of the process. |
| CarbonBlackDefense.Events.Results.process_reputation | String | Reputation of the process. |
| CarbonBlackDefense.Events.Results.process_service_name | String | Service name associated with the process. |
| CarbonBlackDefense.Events.Results.process_sha256 | String | SHA-256 hash of the process. |
| CarbonBlackDefense.Events.Results.process_start_time | Date | Start time of the process. |
| CarbonBlackDefense.Events.Results.process_username | String | Username under which the process is running. |
| CarbonBlackDefense.Events.Results.regmod_count | Number | Number of registry modifications performed by the process. |
| CarbonBlackDefense.Events.Results.scriptload_count | Number | Number of scripts loaded by the process. |
| CarbonBlackDefense.Events.Results.sensor_action | String | Action taken by the sensor for the event. |
| CarbonBlackDefense.Events.Results.ttp | String | Tactics, techniques, and procedures associated with the event. |
| CarbonBlackDefense.Events.Results.watchlist_hit | String | Indicates if the event matches a watchlist entry. |
Command example
!cbd-find-observation device_id=12345
Context Example
{
"CarbonBlackDefense": {
"Events": {
"Results": [
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-05T09:42:06.625Z",
"blocked_effective_reputation": "COMPANY_BLACK_LIST",
"blocked_hash": [
"dummy_bloched_hash"
],
"blocked_name": "c:\windows\system32\sdiagnhost.exe",
"device_group_id": 0,
"device_id": 1234,
"device_name": "desktop-ua4omu0",
"device_policy_id": 1234,
"device_timestamp": "2024-07-05T09:39:07.695Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_description": "The application \"<share><link hash=\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\">C:\Windows\system32\svchost.exe -k DcomLaunch -p</link></share>\" invoked the application \"<share><link hash=\"e5ec6b5b20a16383cc953ad5e478dcdf95ba46281f4fe971673c954d4145c0c4\">c:\windows\system32\sdiagnhost.exe</link></share>\". The operation was <accent>blocked by Carbon Black</accent>.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1720172480035,
"legacy": true,
"observation_description": " sdiagnhost.exe on the Company Black List was detected running. A Deny Policy Action was applied.",
"observation_id": "dummy_observation_id",
"observation_type": "CB_ANALYTICS",
"org_id": "dummy_org_id",
"parent_guid": "dummy_parent_guid",
"parent_pid": 616,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_gash",
"dummy_process_hash"
],
"process_name": "c:\windows\system32\svchost.exe",
"process_pid": [
768
],
"process_username": [
"NT AUTHORITY\SYSTEM"
],
"sensor_action": [
"DENY",
"BLOCK"
]
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-03T16:27:53.810Z",
"blocked_effective_reputation": "COMPANY_BLACK_LIST",
"blocked_hash": [
"dummy_blocked_hash"
],
"blocked_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"device_group_id": 0,
"device_id": 1234,
"device_name": "desktop-ua4omu0",
"device_policy_id": 1234,
"device_timestamp": "2024-07-03T16:25:21.686Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_description": "The application \"<share><link hash=\"20330d3ca71d58f4aeb432676cb6a3d5b97005954e45132fb083e90782efdd50\">c:\windows\system32\backgroundtaskhost.exe</link></share>\" was prevented from accessing the file \"<share><link hash=\"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f\">c:\windows\system32\windowspowershell\v1.0\powershell.exe</link></share>\" due to a <accent>Deny operation or Terminate process</accent> policy action.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1720024053609,
"legacy": true,
"observation_description": "The application backgroundtaskhost.exe invoked another application (powershell.exe). A Deny Policy Action was applied.",
"observation_id": "f82a46c4395811efab18238ba409ec8f:d13802a2-e8a1-180d-8359-fdc0a8c9f007",
"observation_type": "CB_ANALYTICS",
"org_id": "dummy_org_id",
"parent_guid": "dummy_parent_guid",
"parent_pid": 768,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
"dummy_process_hash"
],
"process_name": "c:\windows\system32\backgroundtaskhost.exe",
"process_pid": [
1234
],
"process_username": [
"DESKTOP-UA4OMU0\qe-admin"
],
"sensor_action": [
"DENY",
"BLOCK"
]
}
]
}
}
}
Human Readable Output
Defense Event Results
Event Id Device Id Enriched Event Type 8d815dc93ab211efb74fe9e3b00b3b6a 6685063 CREATE_PROCESS f82a46c4395811efab18238ba409ec8f 6685063 CREATE_PROCESS
cbd-device-search
Searches devices in your organization.
Base Command
cbd-device-search
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. | Optional |
| os | The operating system. Possible values: “WINDOWS”, “MAC”, “LINUX”, and “OTHER”. | Optional |
| status | The status of the device. Possible values: “PENDING”, “REGISTERED”, “DEREGISTERED”, “BYPASS”, “ACTIVE”, “INACTIVE”, “ERROR”, “ALL”, “BYPASS_ON”, “LIVE”, “SENSOR_PENDING_UPDATE”. | Optional |
| start_time | The time to start getting results. specified as ISO-8601 strings for example: “2021-01-27T12:43:26.243Z”. | Optional |
| target_priority | The “Target value” configured in the policy assigned to the sensor. Possible values: “LOW”, “MEDIUM”, “HIGH”, “MISSION_CRITICAL”. | Optional |
| query | The query in Lucene syntax and/or value searches. | Optional |
| end_time | The time to stop getting results. specified as ISO-8601 strings for example: “2021-02-27T12:43:26.243Z”. | Optional |
| rows | The maximum number of rows to return. Default is 20. Default is 20. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Device.activation_code | String | The device activation code to register the sensor with a specific organization. |
| CarbonBlackDefense.Device.activation_code_expiry_time | Date | The time when the activation code expires and cannot be used to register a device. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.ad_group_id | Number | The Active Directory group ID to match. |
| CarbonBlackDefense.Device.appliance_name | String | The name of the appliance the Virtual Machine (VM) is associated with. |
| CarbonBlackDefense.Device.appliance_uuid | String | The UUID of the appliance the VM is associated with. |
| CarbonBlackDefense.Device.av_ave_version | String | The AVE version (part of AV Version). |
| CarbonBlackDefense.Device.av_engine | String | The current antivirus (AV) version. |
| CarbonBlackDefense.Device.av_last_scan_time | Date | The last time a local scan completed. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.av_master | Boolean | Whether the device is an AV Master. |
| CarbonBlackDefense.Device.av_pack_version | String | The pack version (part of AV version). |
| CarbonBlackDefense.Device.av_product_version | String | The product version (part of AV version). |
| CarbonBlackDefense.Device.av_status | String | The status of the local scan. For example [ “AV_ACTIVE”, “AV_REGISTERED” ]. (AV_NOT_REGISTERED, AV_REGISTERED, AV_DEREGISTERED, AV_ACTIVE, AV_BYPASS, SIGNATURE_UPDATE_DISABLED, ONACCESS_SCAN_DISABLED, ONDEMAND_SCAN_DISABLED, PRODUCT_UPDATE_DISABLED). |
| CarbonBlackDefense.Device.av_update_servers | Unknown | A list of the device’s AV servers. For example [ “string”, “string” ]. |
| CarbonBlackDefense.Device.av_vdf_version | String | VDF version (part of AV version). |
| CarbonBlackDefense.Device.cluster_name | String | Name of the cluster. A cluster is a group of hosts. |
| CarbonBlackDefense.Device.current_sensor_policy_name | String | The name of the policy currently configured on the sensor. |
| CarbonBlackDefense.Device.datacenter_name | String | The name of the underlying data center. The data center managed object provides the interface to the common container object for hosts, virtual machines, networks, and datastores. |
| CarbonBlackDefense.Device.deployment_type | String | The device’s deployment type. This is a classification that is determined by its lifecycle management policy. (ENDPOINT, WORKLOAD). |
| CarbonBlackDefense.Device.deregistered_time | Date | The time when the deregister request was received. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.device_meta_data_item_list.key_name | String | The key name that describes the device. |
| CarbonBlackDefense.Device.device_meta_data_item_list.key_value | String | The key value that describes the device. |
| CarbonBlackDefense.Device.device_meta_data_item_list.position | Number | The position that describes the device. |
| CarbonBlackDefense.Device.device_owner_id | Number | The ID of the device owner associated with the device. |
| CarbonBlackDefense.Device.email | String | The email address for the device owner. |
| CarbonBlackDefense.Device.encoded_activation_code | String | The encoded activation code. |
| CarbonBlackDefense.Device.esx_host_name | String | The name of the ESX host on which the VM is deployed. |
| CarbonBlackDefense.Device.esx_host_uuid | String | The UUID of the ESX host on which the VM is deployed. |
| CarbonBlackDefense.Device.first_name | String | The first name of the device owner. |
| CarbonBlackDefense.Device.id | Number | The ID of the device. |
| CarbonBlackDefense.Device.last_contact_time | Date | The last time the sensor contacted Carbon Black Cloud. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_device_policy_changed_time | Date | The last time the sensor changed from one policy to another. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_device_policy_requested_time | Date | The last time the sensor checked for changes to the policy. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_external_ip_address | String | The last IP address of the device according to Carbon Black Cloud. This can differ from the last_internal_ip_address due to the network proxy or NAT. Can be either IPv4 or IPv6 format. |
| CarbonBlackDefense.Device.last_internal_ip_address | String | The last IP address of the device reported by the sensor. Can be either IPv4 or IPv6 format. |
| CarbonBlackDefense.Device.last_location | String | The device’s current location relative to the organization’s network, based on the current IP address and the device’s registered DNS domain suffix. (UNKNOWN, ONSITE, OFFSITE). |
| CarbonBlackDefense.Device.last_name | String | The last name of the device owner. |
| CarbonBlackDefense.Device.last_policy_updated_time | Date | The last time the current policy received an update. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_reported_time | Date | The last time Carbon Black Cloud received one or more events reported by the sensor. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_reset_time | Date | The last time the device was reset. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.last_shutdown_time | Date | The last time the device was shutdown. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.linux_kernel_version | String | Not implemented. |
| CarbonBlackDefense.Device.login_user_name | String | The last user who logged in to the device. (Requires Windows Carbon Black Cloud sensor). |
| CarbonBlackDefense.Device.mac_address | String | The media access control (MAC) address for the device’s primary interface. (Requires Windows CBC sensor version 1.1.1.1 or later, or macOS CBC sensor). |
| CarbonBlackDefense.Device.middle_name | String | The middle name of the device owner. |
| CarbonBlackDefense.Device.name | String | The hostname of the endpoint recorded by the sensor when last initialized. |
| CarbonBlackDefense.Device.organization_id | Number | The organization ID. |
| CarbonBlackDefense.Device.organization_name | String | The organization name. |
| CarbonBlackDefense.Device.os | String | The operating system. (WINDOWS, MAC, LINUX, OTHER). |
| CarbonBlackDefense.Device.os_version | String | The operating system and version of the endpoint. |
| CarbonBlackDefense.Device.passive_mode | Boolean | Whether the device is in bypass mode. |
| CarbonBlackDefense.Device.policy_id | Number | The policy ID assigned to the device. |
| CarbonBlackDefense.Device.policy_name | String | The policy name assigned to the device. This name may not match the current_sensor_policy_name until the sensor checks back in. |
| CarbonBlackDefense.Device.policy_override | Boolean | Whether the policy was manually assigned to override mass sensor management. |
| CarbonBlackDefense.Device.quarantined | Boolean | The indicator that the device is in quarantine mode. |
| CarbonBlackDefense.Device.registered_time | Date | The time when the device was registered with Carbon Black Cloud. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_last_action_time | Date | The last time the background scan was started or stopped. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_last_complete_time | Date | The time the last background scan completed. (ISO 8601 timestamp in UTC). |
| CarbonBlackDefense.Device.scan_status | String | The status of the background scan. (NEVER_RUN, STOPPED, IN_PROGRESS, COMPLETED). |
| CarbonBlackDefense.Device.sensor_kit_type | String | The type of sensor installed on the device. (XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX). |
| CarbonBlackDefense.Device.sensor_out_of_date | Boolean | Whether there is a new version available to be installed. |
| CarbonBlackDefense.Device.sensor_pending_update | Boolean | Whether the sensor is marked by the sensor updater service for a sensor upgrade. |
| CarbonBlackDefense.Device.sensor_states | String | The states the sensor is in. For example [ “ACTIVE”, “LIVE_RESPONSE_ENABLED” ]. (ACTIVE, PANICS_DETECTED, LOOP_DETECTED, DB_CORRUPTION_DETECTED, CSR_ACTION, REPUX_ACTION, DRIVER_INIT_ERROR, REMGR_INIT_ERROR, UNSUPPORTED_OS, SENSOR_UPGRADE_IN_PROGRESS, SENSOR_UNREGISTERED, WATCHDOG, SENSOR_RESET_IN_PROGRESS, DRIVER_INIT_REBOOT_REQUIRED, DRIVER_LOAD_NOT_GRANTED, SENSOR_SHUTDOWN, SENSOR_MAINTENANCE, FULL_DISK_ACCESS_NOT_GRANTED, DEBUG_MODE_ENABLED, AUTO_UPDATE_DISABLED, SELF_PROTECT_DISABLED, VDI_MODE_ENABLED, POC_MODE_ENABLED, SECURITY_CENTER_OPTLN_DISABLED, LIVE_RESPONSE_RUNNING, LIVE_RESPONSE_NOT_RUNNING, LIVE_RESPONSE_KILLED, LIVE_RESPONSE_NOT_KILLED, LIVE_RESPONSE_ENABLED, LIVE_RESPONSE_DISABLED, DRIVER_KERNEL, DRIVER_USERSPACE). |
| CarbonBlackDefense.Device.sensor_version | String | The version of the installed sensor in the format: #.#.#.#. |
| CarbonBlackDefense.Device.status | String | The status of the device. (PENDING, REGISTERED, DEREGISTERED, BYPASS Additional searchable statuses that are not returnable ACTIVE, INACTIVE, ERROR, ALL, BYPASS_ON, LIVE, SENSOR_PENDING_UPDATE). |
| CarbonBlackDefense.Device.target_priority | String | Device target priorities to match. (LOW, MEDIUM, HIGH, MISSION_CRITICAL). |
| CarbonBlackDefense.Device.uninstall_code | String | The code to enter when uninstalling the sensor. |
| CarbonBlackDefense.Device.vcenter_host_url | String | The vCenter host URL. |
| CarbonBlackDefense.Device.vcenter_name | String | The name of the vCenter the VM is associated with. |
| CarbonBlackDefense.Device.vcenter_uuid | String | The 128-bit SMBIOS UUID of a vCenter represented as a hexadecimal string. |
| CarbonBlackDefense.Device.vdi_base_device | Number | The ID of the device from which this device was cloned/re-registered. |
| CarbonBlackDefense.Device.virtual_machine | Boolean | Whether this device is a virtual machine (VMware AppDefense integration). Deprecated for deployment_type. |
| CarbonBlackDefense.Device.virtualization_provider | String | The name of the VM virtualization provider. |
| CarbonBlackDefense.Device.vm_ip | String | The IP address of the VM. |
| CarbonBlackDefense.Device.vm_name | String | The name of the VM that the sensor is deployed on. |
| CarbonBlackDefense.Device.vm_uuid | String | The 128-bit SMBIOS UUID of a virtual machine represented as a hexadecimal string. (Format: 12345678-abcd-1234-cdef-123456789abc). |
| CarbonBlackDefense.Device.vulnerability_score | Number | The vulnerability score from 0 to 100 indicating the workload’s level of vulnerability with 100 being highly vulnerable. |
| CarbonBlackDefense.Device.vulnerability_severity | String | The severity level indicating the workload’s vulnerability. (CRITICAL, MODERATE, IMPORTANT, LOW). |
| CarbonBlackDefense.Device.windows_platform | String | Deprecated for os_version. (CLIENT_X86, CLIENT_X64, SERVER_X86, SERVER_X64, CLIENT_ARM64, SERVER_ARM64). |
Command example
#### Context Example
```json
{
"CarbonBlackDefense": {
"Device": [
{
"activation_code": null,
"activation_code_expiry_time": "2023-01-19T12:11:11.883Z",
"ad_domain": null,
"ad_group_id": 0,
"ad_org_unit": null,
"appliance_name": null,
"appliance_uuid": null,
"asset_group": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"auto_scaling_group_name": null,
"av_ave_version": null,
"av_engine": null,
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": null,
"av_product_version": null,
"av_status": [
"AV_ACTIVE",
"SIGNATURE_UPDATE_DISABLED",
"ONACCESS_SCAN_DISABLED",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": null,
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows 10",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "CB-H10\\Admin",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"golden_device": null,
"golden_device_id": null,
"groups": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"host_based_firewall_reasons": [],
"host_based_firewall_status": null,
"id": "dummy_id",
"infrastructure_provider": "NONE",
"last_contact_time": "2024-07-09T15:30:29.175Z",
"last_device_policy_changed_time": "2024-02-01T10:30:40.624Z",
"last_device_policy_requested_time": "2024-07-09T15:30:31.028Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "OFFSITE",
"last_name": null,
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-07-09T15:30:29.797Z",
"last_reset_time": null,
"last_shutdown_time": "2024-07-09T14:30:21.720Z",
"linux_kernel_version": null,
"login_user_name": "CB-H10\\Admin",
"mac_address": "005056a285bc",
"middle_name": null,
"name": "CB-H10",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows 10 x64",
"passive_mode": false,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2023-01-12T12:11:11.930Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"ACTIVE",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED"
],
"sensor_version": "1.1.1.1",
"status": "REGISTERED",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": 6039303,
"vdi_provider": "NONE",
"virtual_machine": true,
"virtual_private_cloud_id": null,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 0,
"vulnerability_severity": null,
"windows_platform": null
},
{
"activation_code": null,
"activation_code_expiry_time": "2020-10-27T13:49:46.641Z",
"ad_domain": null,
"ad_group_id": 0,
"ad_org_unit": null,
"appliance_name": null,
"appliance_uuid": null,
"asset_group": null,
"auto_scaling_group_name": null,
"av_ave_version": null,
"av_engine": null,
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": null,
"av_product_version": null,
"av_status": [],
"av_update_servers": null,
"av_vdf_version": null,
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "CentOS 7",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "localhost.localdomain",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"golden_device": null,
"golden_device_id": null,
"groups": null,
"host_based_firewall_reasons": [],
"host_based_firewall_status": null,
"id": "dummy_id",
"infrastructure_provider": "NONE",
"last_contact_time": "2024-07-09T15:29:27.472Z",
"last_device_policy_changed_time": "2024-05-24T09:24:52.884Z",
"last_device_policy_requested_time": "2024-06-21T20:15:56.512Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "UNKNOWN",
"last_name": null,
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-07-09T10:51:07.343Z",
"last_reset_time": null,
"last_shutdown_time": null,
"linux_kernel_version": null,
"login_user_name": null,
"mac_address": "0050568135bc",
"middle_name": null,
"name": "localhost.localdomain",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "LINUX",
"os_version": "CentOS 7.9-2009 x64",
"passive_mode": false,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2024-01-31T05:16:55.865Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "RHEL",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"LIVE_RESPONSE_ENABLED",
"LIVE_RESPONSE_NOT_KILLED",
"ACTIVE"
],
"sensor_version": "1.1.1.10133",
"status": "REGISTERED",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"vdi_provider": "NONE",
"virtual_machine": true,
"virtual_private_cloud_id": null,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 9.8,
"vulnerability_severity": "CRITICAL",
"windows_platform": null
},
{
"activation_code": "dummy_activation_code",
"activation_code_expiry_time": "2021-03-08T22:36:37.549Z",
"ad_domain": [
"SDE.LOGRHYTHM.COM"
],
"ad_group_id": 0,
"ad_org_unit": [
"OPERATIONS",
"SERVERS"
],
"appliance_name": null,
"appliance_uuid": null,
"asset_group": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
}
],
"auto_scaling_group_name": null,
"av_ave_version": "1.1.1.1",
"av_engine": "1.1.1.1-ave.1.1.1.1",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": "1.1.1.1",
"av_product_version": "1.1.1.1",
"av_status": [
"AV_ACTIVE",
"SIGNATURE_UPDATE_DISABLED",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": "1.1.1.1",
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows",
"position": 0
},
{
"key_name": "AD_LDAP",
"key_value": "OU=Operations,OU=Servers,DC=sde,DC=logrhythm,DC=com",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "jake.haldeman@logrhythm.com",
"encoded_activation_code": "dummy_encoded_activation_code",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": "Jake",
"golden_device": null,
"golden_device_id": null,
"groups": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
}
],
"host_based_firewall_reasons": [],
"host_based_firewall_status": null,
"id": "dummy_id",
"infrastructure_provider": null,
"last_contact_time": "2024-07-09T15:29:23.630Z",
"last_device_policy_changed_time": "2024-05-24T09:23:08.184Z",
"last_device_policy_requested_time": "2024-06-17T09:22:32.585Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "OFFSITE",
"last_name": "Haldeman",
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-07-05T23:41:48.091Z",
"last_reset_time": null,
"last_shutdown_time": null,
"linux_kernel_version": null,
"login_user_name": "SDE\\luis.castaneda",
"mac_address": "00505694822c",
"middle_name": null,
"name": "SDE\\USBO1SEFS-01",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Server 2012 R2 x64",
"passive_mode": true,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2021-03-01T22:38:55.160Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"REPUX_ACTION",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED"
],
"sensor_version": "1.1.1.19",
"status": "BYPASS",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"vdi_provider": null,
"virtual_machine": true,
"virtual_private_cloud_id": null,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 9.8,
"vulnerability_severity": "CRITICAL",
"windows_platform": null
},
{
"activation_code": null,
"activation_code_expiry_time": "2023-10-27T18:45:09.805Z",
"ad_domain": [
"RTEST.COM"
],
"ad_group_id": 0,
"ad_org_unit": null,
"appliance_name": null,
"appliance_uuid": null,
"asset_group": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"auto_scaling_group_name": null,
"av_ave_version": "1.1.1.1",
"av_engine": "1.1.1.1-ave.1.1.1.1:avpack.1.1.1.1:vdf.1.1.1.1:vdfdate.20231205",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": "1.1.1.1",
"av_product_version": "1.1.1.1",
"av_status": [
"AV_ACTIVE",
"SIGNATURE_UPDATE_DISABLED",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": "1.1.1.1",
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "WORKLOAD",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows 10",
"position": 0
},
{
"key_name": "AD_LDAP",
"key_value": "DC=rtest,DC=com",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "bvanpelt",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"golden_device": null,
"golden_device_id": null,
"groups": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"host_based_firewall_reasons": [],
"host_based_firewall_status": "NOT_ENABLED",
"id": "dummy_id",
"infrastructure_provider": "NONE",
"last_contact_time": "2024-07-09T15:29:05.974Z",
"last_device_policy_changed_time": "2023-12-05T10:14:32.584Z",
"last_device_policy_requested_time": "2024-06-17T09:21:56.441Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "OFFSITE",
"last_name": null,
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-07-09T10:03:10.504Z",
"last_reset_time": null,
"last_shutdown_time": "2024-04-27T00:06:14.478Z",
"linux_kernel_version": null,
"login_user_name": "RTEST\\bvanpelt",
"mac_address": "005056adf705",
"middle_name": null,
"name": "RTEST\\bvp-carbonblack",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows 10 x64",
"passive_mode": false,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2023-10-20T18:45:09.842Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"ACTIVE",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED",
"CB_FIREWALL_INACTIVE"
],
"sensor_version": "1.1.1.18",
"status": "REGISTERED",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"vdi_provider": "NONE",
"virtual_machine": true,
"virtual_private_cloud_id": null,
"virtualization_provider": "VMW_ESX",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 8.8,
"vulnerability_severity": "IMPORTANT",
"windows_platform": null
},
{
"activation_code": null,
"activation_code_expiry_time": "2023-09-10T08:35:13.955Z",
"ad_domain": null,
"ad_group_id": 0,
"ad_org_unit": null,
"appliance_name": null,
"appliance_uuid": null,
"asset_group": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
}
],
"auto_scaling_group_name": null,
"av_ave_version": null,
"av_engine": null,
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": null,
"av_product_version": null,
"av_status": [
"AV_ACTIVE",
"SIGNATURE_UPDATE_DISABLED",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": null,
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": "default",
"datacenter_name": null,
"deployment_type": "ENDPOINT",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows 11",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "microsoftwindowsserver2022datacenterfe8013b5d1a8b08636a7",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"golden_device": null,
"golden_device_id": null,
"groups": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
}
],
"host_based_firewall_reasons": [],
"host_based_firewall_status": "NOT_ENABLED",
"id": "dummy_id",
"infrastructure_provider": "NONE",
"last_contact_time": "2024-07-09T15:28:45.119Z",
"last_device_policy_changed_time": "2024-02-01T10:28:55.298Z",
"last_device_policy_requested_time": "2024-06-17T09:21:35.726Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "OFFSITE",
"last_name": null,
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-07-09T09:04:06.948Z",
"last_reset_time": null,
"last_shutdown_time": "2023-09-13T07:34:15.360Z",
"linux_kernel_version": null,
"login_user_name": "INT01-CARBONBLA\\Administrator",
"mac_address": "0236414d5bd9",
"middle_name": null,
"name": "int01-carbonblack",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows Server 2022 x64",
"passive_mode": true,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": true,
"registered_time": "2023-09-03T08:35:13.991Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"CSR_ACTION",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED",
"CB_FIREWALL_INACTIVE"
],
"sensor_version": "1.1.1.18",
"status": "BYPASS",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"vdi_provider": "NONE",
"virtual_machine": true,
"virtual_private_cloud_id": null,
"virtualization_provider": "OTHER",
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 9.8,
"vulnerability_severity": "CRITICAL",
"windows_platform": null
},
{
"activation_code": null,
"activation_code_expiry_time": "2017-12-21T11:35:18.286Z",
"ad_domain": null,
"ad_group_id": 0,
"ad_org_unit": null,
"appliance_name": null,
"appliance_uuid": null,
"asset_group": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"auto_scaling_group_name": null,
"av_ave_version": "1.1.1.1",
"av_engine": "1.2.3.4-ave.1.2.3.4:avpack.1.2.3.4:vdf.1.2.3.4",
"av_last_scan_time": null,
"av_master": false,
"av_pack_version": "1.1.1.1",
"av_product_version": "1.1.1.1",
"av_status": [
"AV_ACTIVE",
"SIGNATURE_UPDATE_DISABLED",
"ONDEMAND_SCAN_DISABLED"
],
"av_update_servers": null,
"av_vdf_version": "1.1.1.1",
"base_device": null,
"cloud_provider_account_id": null,
"cloud_provider_managed_identity": null,
"cloud_provider_network": null,
"cloud_provider_resource_group": null,
"cloud_provider_resource_id": null,
"cloud_provider_scale_group": null,
"cloud_provider_tags": [],
"cluster_name": null,
"compliance_status": "NOT_ASSESSED",
"current_sensor_policy_name": null,
"datacenter_name": null,
"deployment_type": "ENDPOINT",
"deregistered_time": null,
"device_meta_data_item_list": [
{
"key_name": "OS_MAJOR_VERSION",
"key_value": "Windows",
"position": 0
},
{
"key_name": "SUBNET",
"key_value": "1.1.1.1",
"position": 0
}
],
"device_owner_id": "dummy_device_owner_id",
"email": "EPO-AGENT-PC\\EPO",
"esx_host_name": null,
"esx_host_uuid": null,
"first_name": null,
"golden_device": null,
"golden_device_id": null,
"groups": [
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "My Example Asset Group"
},
{
"id": "dummy_id",
"membership_type": "DYNAMIC",
"name": "Windows No Policy"
}
],
"host_based_firewall_reasons": [],
"host_based_firewall_status": null,
"id": "dummy_id",
"infrastructure_provider": null,
"last_contact_time": "2024-07-09T15:28:44.460Z",
"last_device_policy_changed_time": "2024-01-05T20:26:17.411Z",
"last_device_policy_requested_time": "2024-06-19T15:54:20.202Z",
"last_external_ip_address": "1.1.1.1",
"last_internal_ip_address": "1.1.1.1",
"last_location": "OFFSITE",
"last_name": null,
"last_policy_updated_time": "2024-06-17T09:21:35.212Z",
"last_reported_time": "2024-06-19T16:00:46.224Z",
"last_reset_time": null,
"last_shutdown_time": "2023-07-03T07:29:15.161Z",
"linux_kernel_version": null,
"login_user_name": null,
"mac_address": null,
"middle_name": null,
"name": "EPO-AGENT-PC",
"nsx_distributed_firewall_policy": null,
"nsx_enabled": null,
"organization_id": "dummy_organization_id",
"organization_name": "cb-internal-alliances.com",
"os": "WINDOWS",
"os_version": "Windows 7 x64 SP: 1",
"passive_mode": true,
"policy_assignment_type": "MANUAL",
"policy_id": "dummy_policy_id",
"policy_name": "default",
"policy_override": true,
"quarantined": false,
"registered_time": "2017-12-14T11:35:18.317Z",
"scan_last_action_time": null,
"scan_last_complete_time": null,
"scan_status": null,
"sensor_gateway_url": null,
"sensor_gateway_uuid": null,
"sensor_kit_type": "WINDOWS",
"sensor_out_of_date": true,
"sensor_pending_update": false,
"sensor_states": [
"CSR_ACTION",
"LIVE_RESPONSE_NOT_RUNNING",
"LIVE_RESPONSE_NOT_KILLED",
"LIVE_RESPONSE_ENABLED"
],
"sensor_version": "1.1.1.1",
"status": "BYPASS",
"target_priority": "MEDIUM",
"uninstall_code": "dummy_uninstall_code",
"vcenter_host_url": null,
"vcenter_name": null,
"vcenter_uuid": null,
"vdi_base_device": null,
"vdi_provider": null,
"virtual_machine": false,
"virtual_private_cloud_id": null,
"virtualization_provider": null,
"vm_ip": null,
"vm_name": null,
"vm_uuid": null,
"vulnerability_score": 0,
"vulnerability_severity": null,
"windows_platform": null
}
]
}
}
Human Readable Output
Carbon Black Defense Devices List Results
Id Name Os Policy Name Quarantined Status Target Priority Last Internal Ip Address Last External Ip Address Last Contact Time Last Location 6494305 CB-H10 WINDOWS default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:29.175Z OFFSITE 7762940 cb-linux-1 LINUX default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:22.439Z UNKNOWN 4136358 DESKTOP-F70DSE6 WINDOWS default false BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:20.279Z OFFSITE 6697317 SKOVILLE\pequin WINDOWS default true BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:19.954Z OFFSITE 6227495 CB-MarkoTest WINDOWS default true REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:19.640Z OFFSITE 7533319 R7BETALAB\R7BETALAB-ARW04 WINDOWS AWN BAS false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:09.740Z OFFSITE 7762975 cb-linux-2 LINUX default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:09.305Z UNKNOWN 6268346 Kognos-CB-2 WINDOWS default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:05.050Z OFFSITE 5654865 misp1 LINUX default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:30:04.821Z UNKNOWN 6286530 DESKTOP-PGMSAIE WINDOWS default true REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:52.511Z OFFSITE 8213794 win1122H2new WINDOWS ⚠️ Wide Open false REGISTERED LOW 1.1.1.1 1.1.1.1 2024-07-09T15:29:45.110Z OFFSITE 3777587 bo1tapsandbox-01 LINUX default false BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:40.803Z UNKNOWN 6697325 cayenne LINUX default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:33.955Z UNKNOWN 7773496 localhost.localdomain LINUX default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:27.472Z UNKNOWN 4081930 SDE\USBO1SEFS-01 WINDOWS default false BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:23.630Z OFFSITE 7460343 RTEST\bvp-carbonblack WINDOWS default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:29:05.974Z OFFSITE 6612402 EIP\WW-20003 WINDOWS default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:28:51.666Z OFFSITE 6697318 SKOVILLE\jalapeno WINDOWS default false REGISTERED MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:28:50.821Z OFFSITE 7315458 int01-carbonblack WINDOWS default true BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:28:45.119Z OFFSITE 607519 EPO-AGENT-PC WINDOWS default false BYPASS MEDIUM 1.1.1.1 1.1.1.1 2024-07-09T15:28:44.460Z OFFSITE
cbd-device-quarantine
Quarantines the device. Not supported for devices in a Linux operating system.
Base Command
cbd-device-quarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-unquarantine
Unquarantines the device. Not supported for devices in a Linux operating system.
Base Command
cbd-device-unquarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-background-scan
Starts a background scan on the device. Not supported for devices in a Linux operating system.
Base Command
cbd-device-background-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-background-scan-stop
Stops a background scan on the device. Not supported for devices in a Linux operating system.
Base Command
cbd-device-background-scan-stop
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-bypass
Bypasses a device.
Base Command
cbd-device-bypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-unbypass
Unbypasses a device.
Base Command
cbd-device-unbypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
Context Output
There is no context output for this command.
cbd-device-policy-update
Updates the devices to the specified policy ID.
Base Command
cbd-device-policy-update
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
| policy_id | The ID of the policy. | Required |
Context Output
There is no context output for this command.
cbd-device-update-sensor-version
Updates the version of a sensor.
Base Command
cbd-device-update-sensor-version
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The ID of the device. | Required |
| sensor_version | The new version of the sensor. For example: { “MAC”: “1.1.1.1” }. Supported types: XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX. Possible values are: {“XP”:}, {“WINDOWS”:}, {“MAC”:}, {“AV_SIG”:}, {“OTHER”:}, {“RHEL”:}, {“UBUNTU”:}, {“SUSE”:}, {“AMAZON_LINUX”:}, {“MAC_OSX”:}. | Required |
Context Output
There is no context output for this command.
cbd-find-processes-results
Retrieves the search results using the specified job ID.
Base Command
cbd-find-processes-results
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | When set to false, the function will not use polling and will return the process status or the result if the process is complete. | Optional |
| job_id | The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud. | Required |
| rows | The number of rows to request. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Process.Results.backend_timestamp | Date | The timestamp when the process data was collected from the backend. |
| CarbonBlackDefense.Process.Results.childproc_count | Number | The number of child processes spawned by the process. |
| CarbonBlackDefense.Process.Results.crossproc_count | Number | The number of cross-process interactions involving the process. |
| CarbonBlackDefense.Process.Results.device_id | Number | The unique ID of the device where the process is running. |
| CarbonBlackDefense.Process.Results.device_name | String | The name of the device where the process is running. |
| CarbonBlackDefense.Process.Results.device_policy_id | Number | The policy ID associated with the device. |
| CarbonBlackDefense.Process.Results.device_timestamp | Date | The timestamp when the process data was collected from the device. |
| CarbonBlackDefense.Process.Results.filemod_count | Number | The number of file modifications made by the process. |
| CarbonBlackDefense.Process.Results.index_class | String | The classification of the process based on indexing. |
| CarbonBlackDefense.Process.Results.modload_count | Number | The number of modules loaded by the process. |
| CarbonBlackDefense.Process.Results.netconn_count | Number | The number of network connections established by the process. |
| CarbonBlackDefense.Process.Results.org_id | String | The organization ID associated with the process. |
| CarbonBlackDefense.Process.Results.parent_guid | String | The GUID of the parent process. |
| CarbonBlackDefense.Process.Results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackDefense.Process.Results.partition_id | Number | The partition ID associated with the process. |
| CarbonBlackDefense.Process.Results.process_guid | String | The GUID of the process. |
| CarbonBlackDefense.Process.Results.process_hash | String | The hash of the process. |
| CarbonBlackDefense.Process.Results.process_name | String | The name of the process. |
| CarbonBlackDefense.Process.Results.process_pid | Number | The PID of the process. |
| CarbonBlackDefense.Process.Results.process_username | String | The username under which the process is running. |
| CarbonBlackDefense.Process.Results.regmod_count | Number | The number of registry modifications made by the process. |
| CarbonBlackDefense.Process.Results.scriptload_count | Number | The number of scripts loaded by the process. |
Command example
!cbd-find-processes-results job_id=abc-123 rows=2
Context Example
{
"CarbonBlackDefense": {
"Process": {
"Results": [
{
"alert_category": [
"THREAT"
],
"alert_id": [
"49becb5d-8cca-4b39-b7f4-d94401533dab",
"6038e242-2c44-470c-92e3-bf3a0c32dc26",
"a7056445-388b-46d8-9d8e-3885bfe28fc0"
],
"backend_timestamp": "2024-07-11T14:51:29.069Z",
"childproc_count": 1,
"crossproc_count": 7,
"device_group_id": 0,
"device_id": 12345,
"device_name": "r7betalab\\r7betalab-arw04",
"device_policy_id": 80947,
"device_timestamp": "2024-07-11T14:44:11.754Z",
"filemod_count": 11,
"ingress_time": 1720709467661,
"modload_count": 40,
"netconn_count": 0,
"org_id": "7DESJ9GN",
"parent_guid": "dummy_parent_guid",
"parent_pid": 4380,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
],
"process_name": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"process_pid": [
2192
],
"process_username": [
"R7BETALAB\\svc_idr"
],
"regmod_count": 4,
"scriptload_count": 1,
"watchlist_hit": []
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-11T14:34:13.616Z",
"childproc_count": 0,
"crossproc_count": 0,
"device_group_id": 0,
"device_id": 12345,
"device_name": "cb-markotest",
"device_policy_id": 6525,
"device_timestamp": "2024-07-11T14:30:39.203Z",
"filemod_count": 0,
"ingress_time": 1720708414089,
"modload_count": 0,
"netconn_count": 1,
"org_id": "7DESJ9GN",
"parent_guid": "dummy_parent_guid",
"parent_pid": 688,
"process_guid": "dummy_process_guid",
"process_hash": [],
"process_name": "c:\\windows\\system32\\svchost.exe",
"process_pid": [
2264
],
"process_username": [
"NT AUTHORITY\\NETWORK SERVICE"
],
"regmod_count": 0,
"scriptload_count": 0,
"watchlist_hit": [
"abcd123"
]
}
]
}
}
}
Human Readable Output
The Results For The Process Search
Device Id Device Name Process Name Device Policy Id 1234 r7betalab\r7betalab-arw04 c:\windows\system32\windowspowershell\v1.0\powershell.exe 80947 1111 cb-markotest c:\windows\system32\svchost.exe 6525
cbd-find-observation-details-results
Retrieves the search results using the specified job ID.
Base Command
cbd-find-observation-details-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud. | Required |
| rows | The number of rows to request. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.EventDetails.Results.alert_category | String | The category of the alert associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.alert_id | String | The unique ID of the alert associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.backend_timestamp | Date | The timestamp when the observation data was collected from the backend. |
| CarbonBlackDefense.EventDetails.Results.childproc_count | Number | The number of child processes spawned by the observed process. |
| CarbonBlackDefense.EventDetails.Results.crossproc_count | Number | The number of cross-process interactions involving the observed process. |
| CarbonBlackDefense.EventDetails.Results.device_external_ip | String | The external IP address of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_group_id | Number | The group ID associated with the device. |
| CarbonBlackDefense.EventDetails.Results.device_id | Number | The unique ID of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_installed_by | String | The user or process that installed the device. |
| CarbonBlackDefense.EventDetails.Results.device_internal_ip | String | The internal IP address of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_location | String | The physical or network location of the device. |
| CarbonBlackDefense.EventDetails.Results.device_name | String | The name of the device where the observation was made. |
| CarbonBlackDefense.EventDetails.Results.device_os | String | The operating system of the device. |
| CarbonBlackDefense.EventDetails.Results.device_os_version | String | The version of the operating system of the device. |
| CarbonBlackDefense.EventDetails.Results.device_policy | String | The policy applied to the device. |
| CarbonBlackDefense.EventDetails.Results.device_policy_id | Number | The unique ID of the policy applied to the device. |
| CarbonBlackDefense.EventDetails.Results.device_sensor_version | String | The version of the sensor installed on the device. |
| CarbonBlackDefense.EventDetails.Results.device_target_priority | String | The priority level of the device as a target. |
| CarbonBlackDefense.EventDetails.Results.device_timestamp | Date | The timestamp when the observation was recorded on the device. |
| CarbonBlackDefense.EventDetails.Results.document_guid | String | The GUID of the document associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.enriched | Boolean | Indicates whether the observation data has been enriched with additional information. |
| CarbonBlackDefense.EventDetails.Results.enriched_event_type | String | The type of event after enrichment. |
| CarbonBlackDefense.EventDetails.Results.event_threat_score | Number | The threat score associated with the event. |
| CarbonBlackDefense.EventDetails.Results.filemod_count | Number | The number of file modifications made by the observed process. |
| CarbonBlackDefense.EventDetails.Results.ingress_time | Date | The time when the observation data was ingested into the system. |
| CarbonBlackDefense.EventDetails.Results.legacy | Boolean | Indicates whether the observation is from a legacy system or data source. |
| CarbonBlackDefense.EventDetails.Results.modload_count | Number | The number of modules loaded by the observed process. |
| CarbonBlackDefense.EventDetails.Results.netconn_count | Number | The number of network connections established by the observed process. |
| CarbonBlackDefense.EventDetails.Results.observation_description | String | A description of the observation. |
| CarbonBlackDefense.EventDetails.Results.observation_id | String | The unique observation ID |
| CarbonBlackDefense.EventDetails.Results.observation_type | String | The type of observation. |
| CarbonBlackDefense.EventDetails.Results.org_id | String | The organization ID associated with the observation. |
| CarbonBlackDefense.EventDetails.Results.parent_cmdline | String | The command line arguments of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_cmdline_length | Number | The length of the command line arguments of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_effective_reputation | String | The effective reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_effective_reputation_source | String | The source of the effective reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_guid | String | The GUID of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_hash | String | The hash of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_name | String | The name of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_publisher | String | The publisher of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_publisher_state | String | The state of the publisher of the parent process. |
| CarbonBlackDefense.EventDetails.Results.parent_reputation | String | The reputation of the parent process. |
| CarbonBlackDefense.EventDetails.Results.process_cmdline | String | The command line arguments of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_cmdline_length | Number | The length of the command line arguments of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_company_name | String | The company name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_effective_reputation | String | The effective reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_effective_reputation_source | String | The source of the effective reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_elevated | Boolean | Indicates whether the observed process is running with elevated privileges. |
| CarbonBlackDefense.EventDetails.Results.process_file_description | String | The description of the observed process file. |
| CarbonBlackDefense.EventDetails.Results.process_guid | String | The GUID of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_hash | String | The hash of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_integrity_level | String | The integrity level of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_internal_name | String | The internal name of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_name | String | The name of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_original_filename | String | The original filename of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_pid | Number | The PID of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_privileges | String | The privileges associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_product_name | String | The product name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_product_version | String | The product version associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_publisher | String | The publisher of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_publisher_state | String | The state of the publisher of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_reputation | String | The reputation of the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_service_name | String | The service name associated with the observed process. |
| CarbonBlackDefense.EventDetails.Results.process_sha256 | unknown | The SHA-256 hash. |
Command example
!cbd-find-observation-details-results job_id=abc-1234 rows=2
Context Example
{
"CarbonBlackDefense": {
"EventDetails": {
"Results": {
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-04-17T01:52:29.056Z",
"blocked_effective_reputation": "TRUSTED_WHITE_LIST",
"blocked_hash": [
"dummy_blocked_hash"
],
"blocked_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"childproc_cmdline": "\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow() ",
"childproc_cmdline_length": 124,
"childproc_effective_reputation": "TRUSTED_WHITE_LIST",
"childproc_effective_reputation_source": "CLOUD",
"childproc_guid": "dummy_childproc_guid",
"childproc_hash": [
"dummy_chidproc_hash"
],
"childproc_issuer": [
"Microsoft Windows Production PCA 2011"
],
"childproc_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"childproc_pid": 1020,
"childproc_publisher": [
"Microsoft Windows"
],
"childproc_publisher_state": [
"FILE_SIGNATURE_STATE_VERIFIED",
"FILE_SIGNATURE_STATE_SIGNED"
],
"childproc_reputation": "TRUSTED_WHITE_LIST",
"childproc_username": "NT AUTHORITY\SYSTEM",
"device_external_ip": "1.1.1.1",
"device_group_id": 0,
"device_id": 12345,
"device_installed_by": "user@example.com",
"device_internal_ip": "1.1.1.1",
"device_location": "OFFSITE",
"device_name": "corp\wsamzn-lshqdrdc",
"device_os": "WINDOWS",
"device_os_version": "Windows Server 2019 x64",
"device_policy": "tines-policy",
"device_policy_id": 1234,
"device_sensor_version": "1.1.1.1",
"device_target_priority": "LOW",
"device_timestamp": "2024-04-17T01:50:54.057Z",
"document_guid": "dummy_document_guid",
"enriched": true,
"enriched_event_type": "CREATE_PROCESS",
"event_attack_stage": [
"INSTALL_RUN"
],
"event_description": "The script \"<share><link hash=\"dummy_hash\">C:\program files\amazon\skylight\scripts\windows_update_status.ps1</link></share>\" invoked the application \"<share><link hash=\"dummy_hash\">C:\windows\system32\windowspowershell\v1.0\powershell.exe</link></share>\". The operation was <accent>blocked</accent> and the application <accent>terminated by Carbon Black</accent>.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1713318735609,
"legacy": true,
"observation_description": "The application windows_update_status.ps1 invoked another application (powershell.exe). A Deny Policy Action was applied.",
"observation_id": "dummy_observation_id",
"observation_type": "CB_ANALYTICS",
"org_id": "abc123",
"parent_effective_reputation": "LOCAL_WHITE",
"parent_effective_reputation_source": "PRE_EXISTING",
"parent_guid": "dummy_parent_guid",
"parent_hash": [
"dummy_parent_hash"
],
"parent_name": "c:\program files\amazon\skylight\skylightworkspaceconfigservice.exe",
"parent_pid": 1234,
"parent_reputation": "NOT_LISTED",
"parent_username": "NT AUTHORITY\SYSTEM",
"process_cmdline": [
"\"powershell.exe\" -NonInteractive -ExecutionPolicy AllSigned -File \"C:\Program files\Amazon\SkyLight\scripts\windows_update_status.ps1\" -scriptId windows_update_status.ps1 CheckStatus"
],
"process_cmdline_length": [
182
],
"process_effective_reputation": "ADAPTIVE_WHITE_LIST",
"process_effective_reputation_source": "CLOUD",
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
],
"process_loaded_script_hash": [
"dummy_process_loaded_script_hash"
],
"process_loaded_script_name": [
"c:\program files\amazon\skylight\scripts\windows_update_status.ps1"
],
"process_name": "c:\program files\amazon\skylight\scripts\windows_update_status.ps1",
"process_pid": [
1234
],
"process_reputation": "NOT_LISTED",
"process_sha256": "dummy_process_sha256",
"process_start_time": "2024-04-17T01:50:48.244Z",
"process_user_id": "S-1-5-18",
"process_username": [
"NT AUTHORITY\SYSTEM"
],
"sensor_action": [
"TERMINATE"
],
"ttp": [
"MITRE_T1059_CMD_LINE_OR_SCRIPT_INTER",
"POLICY_DENY",
"MITRE_T1059_001_POWERSHELL"
]
}
}
}
}
Human Readable Output
Defense Event Details Results
Observation Id Event Id Device Id Device External Ip Device Internal Ip Enriched Event Type dummy_observation_id dummy_event_id 1234 1.1.1.1 1.1.1.1 CREATE_PROCESS
cbd-find-observation-results
Retrieves the search results using the specified job ID.
Base Command
cbd-find-observation-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud. | Required |
| rows | The number of rows to request. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackDefense.Events.Results.alert_category | String | Category of the alert associated with the event. |
| CarbonBlackDefense.Events.Results.alert_id | String | The unique alert ID. |
| CarbonBlackDefense.Events.Results.backend_timestamp | Date | Timestamp when the event was processed on the backend. |
| CarbonBlackDefense.Events.Results.childproc_count | Number | Number of child processes spawned by the process. |
| CarbonBlackDefense.Events.Results.crossproc_count | Number | Number of cross-process operations performed by the process. |
| CarbonBlackDefense.Events.Results.device_external_ip | String | External IP address of the device. |
| CarbonBlackDefense.Events.Results.device_group_id | Number | The device group ID. |
| CarbonBlackDefense.Events.Results.device_id | Number | The unique device ID. |
| CarbonBlackDefense.Events.Results.device_installed_by | String | User or entity that installed the device. |
| CarbonBlackDefense.Events.Results.device_internal_ip | String | Internal IP address of the device. |
| CarbonBlackDefense.Events.Results.device_location | String | Physical or network location of the device. |
| CarbonBlackDefense.Events.Results.device_name | String | Name of the device. |
| CarbonBlackDefense.Events.Results.device_os | String | Operating system running on the device. |
| CarbonBlackDefense.Events.Results.device_os_version | String | Version of the operating system running on the device. |
| CarbonBlackDefense.Events.Results.device_policy | String | Security policy applied to the device. |
| CarbonBlackDefense.Events.Results.device_policy_id | Number | The ID of the security policy applied to the device. |
| CarbonBlackDefense.Events.Results.device_sensor_version | String | Version of the sensor installed on the device. |
| CarbonBlackDefense.Events.Results.device_target_priority | String | Priority of the device as a target. |
| CarbonBlackDefense.Events.Results.device_timestamp | Date | Timestamp of the event as recorded by the device. |
| CarbonBlackDefense.Events.Results.document_guid | String | The global unique ID for the document associated with the event. |
| CarbonBlackDefense.Events.Results.enriched | Boolean | Indicates whether the event data has been enriched. |
| CarbonBlackDefense.Events.Results.enriched_event_type | String | Type of the enriched event. |
| CarbonBlackDefense.Events.Results.event_threat_score | Number | Threat score assigned to the event. |
| CarbonBlackDefense.Events.Results.filemod_count | Number | Number of file modifications performed by the process. |
| CarbonBlackDefense.Events.Results.ingress_time | Date | Time when the event was ingested by the system. |
| CarbonBlackDefense.Events.Results.legacy | Boolean | Indicates whether the event is considered a legacy event. |
| CarbonBlackDefense.Events.Results.modload_count | Number | Number of modules loaded by the process. |
| CarbonBlackDefense.Events.Results.netconn_count | Number | Number of network connections established by the process. |
| CarbonBlackDefense.Events.Results.observation_description | String | Description of the observation associated with the event. |
| CarbonBlackDefense.Events.Results.observation_id | String | The unique observation ID. |
| CarbonBlackDefense.Events.Results.observation_type | String | Type of the observation associated with the event. |
| CarbonBlackDefense.Events.Results.org_id | String | The ID of the organization associated with the event. |
| CarbonBlackDefense.Events.Results.parent_cmdline | String | Command line used to execute the parent process. |
| CarbonBlackDefense.Events.Results.parent_cmdline_length | Number | Length of the command line used to execute the parent process. |
| CarbonBlackDefense.Events.Results.parent_effective_reputation | String | Effective reputation of the parent process. |
| CarbonBlackDefense.Events.Results.parent_effective_reputation_source | String | Source of the effective reputation of the parent process. |
| CarbonBlackDefense.Events.Results.parent_guid | String | The global unique ID for the parent process. |
| CarbonBlackDefense.Events.Results.parent_hash | String | Hash of the parent process. |
| CarbonBlackDefense.Events.Results.parent_name | String | Name of the parent process. |
| CarbonBlackDefense.Events.Results.parent_pid | Number | The process ID of the parent process. |
| CarbonBlackDefense.Events.Results.parent_publisher | String | Publisher of the parent process. |
| CarbonBlackDefense.Events.Results.parent_publisher_state | String | Publisher state of the parent process. |
| CarbonBlackDefense.Events.Results.parent_reputation | String | Reputation of the parent process. |
| CarbonBlackDefense.Events.Results.process_cmdline | String | Command line used to execute the process. |
| CarbonBlackDefense.Events.Results.process_cmdline_length | Number | Length of the command line used to execute the process. |
| CarbonBlackDefense.Events.Results.process_company_name | String | Company name associated with the process. |
| CarbonBlackDefense.Events.Results.process_effective_reputation | String | Effective reputation of the process. |
| CarbonBlackDefense.Events.Results.process_effective_reputation_source | String | Source of the effective reputation of the process. |
| CarbonBlackDefense.Events.Results.process_elevated | Boolean | Indicates whether the process is running with elevated privileges. |
| CarbonBlackDefense.Events.Results.process_file_description | String | File description of the process. |
| CarbonBlackDefense.Events.Results.process_guid | String | The global unique process ID. |
| CarbonBlackDefense.Events.Results.process_hash | String | Hash of the process. |
| CarbonBlackDefense.Events.Results.process_integrity_level | String | Integrity level of the process. |
| CarbonBlackDefense.Events.Results.process_internal_name | String | Internal name of the process. |
| CarbonBlackDefense.Events.Results.process_name | String | Name of the process. |
| CarbonBlackDefense.Events.Results.process_original_filename | String | Original filename of the process. |
| CarbonBlackDefense.Events.Results.process_pid | Number | The process ID of the process. |
| CarbonBlackDefense.Events.Results.process_privileges | String | Privileges associated with the process. |
| CarbonBlackDefense.Events.Results.process_product_name | String | Product name associated with the process. |
| CarbonBlackDefense.Events.Results.process_product_version | String | Product version associated with the process. |
| CarbonBlackDefense.Events.Results.process_publisher | String | Publisher of the process. |
| CarbonBlackDefense.Events.Results.process_publisher_state | String | Publisher state of the process. |
| CarbonBlackDefense.Events.Results.process_reputation | String | Reputation of the process. |
| CarbonBlackDefense.Events.Results.process_service_name | String | Service name associated with the process. |
| CarbonBlackDefense.Events.Results.process_sha256 | String | SHA-256 hash of the process. |
| CarbonBlackDefense.Events.Results.process_start_time | Date | Start time of the process. |
| CarbonBlackDefense.Events.Results.process_username | String | Username under which the process is running. |
| CarbonBlackDefense.Events.Results.regmod_count | Number | Number of registry modifications performed by the process. |
| CarbonBlackDefense.Events.Results.scriptload_count | Number | Number of scripts loaded by the process. |
| CarbonBlackDefense.Events.Results.sensor_action | String | Action taken by the sensor for the event. |
| CarbonBlackDefense.Events.Results.ttp | String | Tactics, techniques, and procedures associated with the event. |
| CarbonBlackDefense.Events.Results.watchlist_hit | String | Indicates if the event matches a watchlist entry. |
Command example
!cbd-find-observation-results job_id=abc-1234 rows=2
Context Example
{
"CarbonBlackDefense": {
"Events": {
"Results": [
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-05T09:42:06.625Z",
"blocked_effective_reputation": "COMPANY_BLACK_LIST",
"blocked_hash": [
"dummy_bloched_hash"
],
"blocked_name": "c:\windows\system32\sdiagnhost.exe",
"device_group_id": 0,
"device_id": 1234,
"device_name": "desktop-ua4omu0",
"device_policy_id": 1234,
"device_timestamp": "2024-07-05T09:39:07.695Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_description": "The application \"<share><link hash=\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\">C:\Windows\system32\svchost.exe -k DcomLaunch -p</link></share>\" invoked the application \"<share><link hash=\"e5ec6b5b20a16383cc953ad5e478dcdf95ba46281f4fe971673c954d4145c0c4\">c:\windows\system32\sdiagnhost.exe</link></share>\". The operation was <accent>blocked by Carbon Black</accent>.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1720172480035,
"legacy": true,
"observation_description": " sdiagnhost.exe on the Company Black List was detected running. A Deny Policy Action was applied.",
"observation_id": "dummy_observation_id",
"observation_type": "CB_ANALYTICS",
"org_id": "dummy_org_id",
"parent_guid": "dummy_parent_guid",
"parent_pid": 616,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_gash",
"dummy_process_hash"
],
"process_name": "c:\windows\system32\svchost.exe",
"process_pid": [
768
],
"process_username": [
"NT AUTHORITY\SYSTEM"
],
"sensor_action": [
"DENY",
"BLOCK"
]
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"dummy_alert_id"
],
"backend_timestamp": "2024-07-03T16:27:53.810Z",
"blocked_effective_reputation": "COMPANY_BLACK_LIST",
"blocked_hash": [
"dummy_blocked_hash"
],
"blocked_name": "c:\windows\system32\windowspowershell\v1.0\powershell.exe",
"device_group_id": 0,
"device_id": 1234,
"device_name": "desktop-ua4omu0",
"device_policy_id": 1234,
"device_timestamp": "2024-07-03T16:25:21.686Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_description": "The application \"<share><link hash=\"20330d3ca71d58f4aeb432676cb6a3d5b97005954e45132fb083e90782efdd50\">c:\windows\system32\backgroundtaskhost.exe</link></share>\" was prevented from accessing the file \"<share><link hash=\"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f\">c:\windows\system32\windowspowershell\v1.0\powershell.exe</link></share>\" due to a <accent>Deny operation or Terminate process</accent> policy action.",
"event_id": "dummy_event_id",
"event_type": "childproc",
"ingress_time": 1720024053609,
"legacy": true,
"observation_description": "The application backgroundtaskhost.exe invoked another application (powershell.exe). A Deny Policy Action was applied.",
"observation_id": "f82a46c4395811efab18238ba409ec8f:d13802a2-e8a1-180d-8359-fdc0a8c9f007",
"observation_type": "CB_ANALYTICS",
"org_id": "dummy_org_id",
"parent_guid": "dummy_parent_guid",
"parent_pid": 768,
"process_guid": "dummy_process_guid",
"process_hash": [
"dummy_process_hash",
"dummy_process_hash"
],
"process_name": "c:\windows\system32\backgroundtaskhost.exe",
"process_pid": [
1234
],
"process_username": [
"DESKTOP-UA4OMU0\qe-admin"
],
"sensor_action": [
"DENY",
"BLOCK"
]
}
]
}
}
}
Human Readable Output
Defense Event Results
Event Id Device Id Enriched Event Type 8d815dc93ab211efb74fe9e3b00b3b6a 6685063 CREATE_PROCESS f82a46c4395811efab18238ba409ec8f 6685063 CREATE_PROCESS
Configuration parameters
url— URL (required)organization_key— Organization Key (required)custom_credentials— Custom Api Keylive_response_credentials— Api Key (Api/Live Response key)incidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidentsinsecure— Trust any certificate (not secure)proxy— Use system proxy settingstype— The type of the alertdevice_id— Device IDpolicy_id— Policy IDdevice_username— Device usernamemin_severity— Minimum severityquery— Queryfirst_fetch— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).max_fetch— Maximum number of incidents per fetch
Commands (26)
-
cbd-add-rule-to-policyAdds a new rule to an existing policy. Note: System policies cannot be modified.
-
cbd-alerts-searchGets alert details, including alert metadata and the event associated with the alert.
-
cbd-create-policyCreates a new policy on the CB Defense backend.
-
cbd-delete-policyDeletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.
-
cbd-delete-rule-from-policyRemoves a rule from an existing policy. Note: System policies cannot be modified.
-
cbd-device-background-scanStarts a background scan on the device. Not supported for devices in a Linux operating system.
-
cbd-device-background-scan-stopStops a background scan on the device. Not supported for devices in a Linux operating system.
-
cbd-device-bypassBypasses a device.
-
cbd-device-policy-updateUpdates the devices to the specified policy ID.
-
cbd-device-quarantineQuarantines the device. Not supported for devices in a Linux operating system.
-
cbd-device-searchSearches devices in your organization.
-
cbd-device-unbypassUnbypasses a device.
-
cbd-device-unquarantineUnquarantines the device. Not supported for devices in a Linux operating system.
-
cbd-device-update-sensor-versionUpdates the version of a sensor.
-
cbd-find-observationFetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion.
-
cbd-find-observation-detailsFetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion.
-
cbd-find-observation-details-resultsRetrieves the search results using the specified job ID.
-
cbd-find-observation-resultsRetrieves the search results using the specified job ID.
-
cbd-find-processesCreates a process search job and retrieves the search results. At least one of the arguments (not including: rows, start, and time_range) is required.
-
cbd-find-processes-resultsRetrieves the search results using the specified job ID.
-
cbd-get-alert-detailsGets alert details according to alert ID, including alert metadata and a list of all events associated with the alert. Only API keys of type “API” can call the alert API.
-
cbd-get-policies-summaryGet an overview of the policies available in the organization.
-
cbd-get-policyRetrieves a policy object by ID.
-
cbd-set-policySet existing policy's fields on the CB Defense backend.
-
cbd-update-policyUpdate an existing policy on the CB Defense backend.
-
cbd-update-rule-in-policyUpdates an existing rule with a new rule. Note: System policies cannot be modified.
category: Endpoint sectionorder: - Connect - Collect provider: Broadcom commonfields: id: Carbon Black Endpoint Standard v3 version: -1 configuration: - name: url defaultvalue: https://defense.conferdeploy.net/ display: URL required: true type: 0 section: Connect - name: organization_key display: Organization Key type: 0 required: true section: Connect - name: custom_credentials display: Custom Api Key type: 9 required: false additionalinfo: Also required for fetch section: Connect - name: live_response_credentials display: Api Key (Api/Live Response key) type: 9 required: false section: Connect - name: incidentType display: Incident type type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - name: isFetch display: Fetch incidents type: 8 required: false section: Collect - name: insecure display: Trust any certificate (not secure) type: 8 required: false section: Connect - name: proxy display: Use system proxy settings type: 8 required: false section: Connect - name: type display: The type of the alert defaultvalue: all options: - cbanalytics - containerruntime - devicecontrol - hostnasedfirewall - intrusiondetectionsystem - watchlist - all type: 15 required: false additionalinfo: Type of alert to be fetched. section: Collect - name: device_id display: Device ID type: 0 required: false additionalinfo: The alerts related to a specific device, according to the device ID. section: Collect - name: policy_id display: Policy ID type: 0 required: false additionalinfo: The alerts related to a specific policy, according to the policy ID. section: Collect - name: device_username display: Device username type: 0 required: false additionalinfo: The alerts related to a specific device, according to the device username. section: Collect - name: min_severity display: Minimum severity options: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' - '10' type: 15 required: false additionalinfo: The minimum severity of the alerts to be fetched. section: Collect - name: query display: Query type: 0 required: false additionalinfo: Query in Lucene syntax and/or value searches. If defined, the other fetch incidents parameters should be left blank. section: Collect - name: first_fetch display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). type: 0 required: false defaultvalue: 7 days section: Collect - name: max_fetch display: Maximum number of incidents per fetch type: 0 required: false defaultvalue: '50' section: Collect description: Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set. display: Carbon Black Endpoint Standard v3 name: Carbon Black Endpoint Standard v3 script: commands: - name: cbd-get-alert-details arguments: - name: alertId description: The ID of the alert. required: true description: Gets alert details according to alert ID, including alert metadata and a list of all events associated with the alert. Only API keys of type “API” can call the alert API. outputs: - contextPath: CarbonBlackDefense.Alert.org_key description: The organization key associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.alert_url description: The URL to view the alert in the Carbon Black Defense console. type: String - contextPath: CarbonBlackDefense.Alert.id description: The unique alert ID. type: String - contextPath: CarbonBlackDefense.Alert.type description: The type of the alert. type: String - contextPath: CarbonBlackDefense.Alert.backend_timestamp description: The timestamp when the alert was generated in the backend. type: Date - contextPath: CarbonBlackDefense.Alert.user_update_timestamp description: The timestamp when the alert was last updated by a user. type: Date - contextPath: CarbonBlackDefense.Alert.backend_update_timestamp description: The timestamp when the alert was last updated in the backend. type: Date - contextPath: CarbonBlackDefense.Alert.detection_timestamp description: The timestamp when the alert was detected. type: Date - contextPath: CarbonBlackDefense.Alert.first_event_timestamp description: The timestamp of the first event related to the alert. type: Date - contextPath: CarbonBlackDefense.Alert.last_event_timestamp description: The timestamp of the last event related to the alert. type: Date - contextPath: CarbonBlackDefense.Alert.severity description: The severity level of the alert. type: Number - contextPath: CarbonBlackDefense.Alert.reason description: The reason for the alert. type: String - contextPath: CarbonBlackDefense.Alert.reason_code description: The reason code for the alert. type: String - contextPath: CarbonBlackDefense.Alert.threat_id description: The threat ID related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.primary_event_id description: The primary event ID related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.policy_applied description: The policy applied to the device when the alert was generated. type: String - contextPath: CarbonBlackDefense.Alert.run_state description: The run state of the alert. type: String - contextPath: CarbonBlackDefense.Alert.sensor_action description: The action taken by the sensor for the alert. type: String - contextPath: CarbonBlackDefense.Alert.workflow.change_timestamp description: The timestamp when the workflow status was last changed. type: Date - contextPath: CarbonBlackDefense.Alert.workflow.changed_by_type description: The type of user who last changed the workflow status. type: String - contextPath: CarbonBlackDefense.Alert.workflow.changed_by description: The user who last changed the workflow status. type: String - contextPath: CarbonBlackDefense.Alert.workflow.closure_reason description: The reason for closing the alert. type: String - contextPath: CarbonBlackDefense.Alert.workflow.status description: The current workflow status of the alert. type: String - contextPath: CarbonBlackDefense.Alert.determination.change_timestamp description: The timestamp when the determination was last changed. type: Date - contextPath: CarbonBlackDefense.Alert.determination.value description: The value of the determination. type: String - contextPath: CarbonBlackDefense.Alert.determination.changed_by_type description: The type of user who last changed the determination. type: String - contextPath: CarbonBlackDefense.Alert.determination.changed_by description: The user who last changed the determination. type: String - contextPath: CarbonBlackDefense.Alert.tags description: The tags associated with the alert. type: Unknown - contextPath: CarbonBlackDefense.Alert.alert_notes_present description: Indicates whether alert notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.threat_notes_present description: Indicates whether threat notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.alert_origin description: The origin of the alert. type: String - contextPath: CarbonBlackDefense.Alert.is_updated description: Indicates whether the alert has been updated. type: Boolean - contextPath: CarbonBlackDefense.Alert.device_id description: The identifier of the device related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.device_name description: The name of the device related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.device_uem_id description: The Unified Endpoint Management (UEM) ID of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_target_value description: The target value of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_policy description: The policy applied to the device. type: String - contextPath: CarbonBlackDefense.Alert.device_policy_id description: The policy ID applied to the device. type: Number - contextPath: CarbonBlackDefense.Alert.device_os description: The operating system of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_os_version description: The operating system version of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_username description: The username associated with the device. type: String - contextPath: CarbonBlackDefense.Alert.device_location description: The location of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_external_ip description: The external IP address of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_internal_ip description: The internal IP address of the device. type: String - contextPath: CarbonBlackDefense.Alert.asset_group description: The asset group to which the device belongs. type: Unknown - contextPath: CarbonBlackDefense.Alert.mdr_alert description: Indicates whether the alert is a Managed Detection and Response (MDR) alert. type: Boolean - contextPath: CarbonBlackDefense.Alert.mdr_alert_notes_present description: Indicates whether MDR alert notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.mdr_threat_notes_present description: Indicates whether MDR threat notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.report_id description: The report ID associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.report_name description: The name of the report associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.report_description description: The description of the report associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.report_tags description: The tags associated with the report. type: String - contextPath: CarbonBlackDefense.Alert.report_link description: The link to the report associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.ioc_id description: The indicator of compromise (IOC) ID related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.ioc_hit description: The IOC hit associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.watchlists.id description: The watchlist ID associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.watchlists.name description: The name of the watchlist associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_guid description: The GUID of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_pid description: The PID of the process related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.process_name description: The name of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_sha256 description: The SHA-256 hash of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_md5 description: The MD5 hash of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_effective_reputation description: The effective reputation of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_reputation description: The reputation of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_cmdline description: The command line of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_username description: The username associated with the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_issuer description: The issuer of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_publisher description: The publisher of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_guid description: The GUID of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_pid description: The PID of the parent process related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.parent_name description: The name of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_sha256 description: The SHA-256 hash of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_md5 description: The MD5 hash of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_effective_reputation description: The effective reputation of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_reputation description: The reputation of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_cmdline description: The command line of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_username description: The username associated with the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_guid description: The GUID of the child process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_username description: The username associated with the child process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_cmdline description: The command line of the child process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.ml_classification_final_verdict description: The final verdict from the machine learning classification. type: String - contextPath: CarbonBlackDefense.Alert.ml_classification_global_prevalence description: The global prevalence from the machine learning classification. type: String - contextPath: CarbonBlackDefense.Alert.ml_classification_org_prevalence description: The organizational prevalence from the machine learning classification. type: String - contextPath: CarbonBlackDefense.Alert.ml_classification_anomalies description: The anomalies identified by the machine learning classification. type: Unknown - name: cbd-alerts-search arguments: - name: type description: The alert type. auto: PREDEFINED predefined: - cbanalytics - containerruntime - devicecontrol - hostnasedfirewall - intrusiondetectionsystem - watchlist - all defaultValue: all - name: device_id description: The device ID. - name: first_event_time description: 'The time of the first event associated with the alert. The syntax is {"start": "<dateTime>", "range": "<string>", "end": "<dateTime>" }. For example: { "start": "2010-09-25T00:10:50.277Z", "end": "2015-01-20T10:40:00.00Z"}.' - name: policy_id description: The policy ID. - name: process_sha256 description: The SHA-256 hash of the primary involved process. - name: reputation auto: PREDEFINED predefined: - ADAPTIVE_WHITE_LIST - COMMON_WHITE_LIST - COMPANY_BLACK_LIST - COMPANY_WHITE_LIST - PUP - TRUSTED_WHITE_LIST - RESOLVING - COMPROMISED_OBSOLETE - DLP_OBSOLETE - IGNORE - ADWARE - HEURISTIC - SUSPECT_MALWARE - KNOWN_MALWARE - ADMIN_RESTRICT_OBSOLETE - NOT_LISTED - GRAY_OBSOLETE - NOT_COMPANY_WHITE_OBSOLETE - LOCAL_WHITE - NOT_SUPPORTED description: 'The reputation of the primary involved process.' - name: tags description: The tags associated with the alert. - name: device_username description: The username of the user logged on during the alert. If the user is not available, the device owner is used. - name: query description: The query in Lucene syntax and/or value searches. - name: rows description: The number of results to be returned. - name: start description: The number of the alert from where to start retrieving results. description: Gets alert details, including alert metadata and the event associated with the alert. outputs: - contextPath: CarbonBlackDefense.Alert.org_key description: The organization key associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.alert_url description: The URL to view the alert in the Carbon Black Defense console. type: String - contextPath: CarbonBlackDefense.Alert.id description: The unique alert ID. type: String - contextPath: CarbonBlackDefense.Alert.type description: The type of the alert. type: String - contextPath: CarbonBlackDefense.Alert.backend_timestamp description: The timestamp when the alert was generated in the backend. type: Date - contextPath: CarbonBlackDefense.Alert.user_update_timestamp description: The timestamp when the alert was last updated by a user. type: Unknown - contextPath: CarbonBlackDefense.Alert.backend_update_timestamp description: The timestamp when the alert was last updated in the backend. type: Date - contextPath: CarbonBlackDefense.Alert.detection_timestamp description: The timestamp when the alert was detected. type: Date - contextPath: CarbonBlackDefense.Alert.first_event_timestamp description: The timestamp of the first event related to the alert. type: Date - contextPath: CarbonBlackDefense.Alert.last_event_timestamp description: The timestamp of the last event related to the alert. type: Date - contextPath: CarbonBlackDefense.Alert.severity description: The severity level of the alert. type: Number - contextPath: CarbonBlackDefense.Alert.reason description: The reason for the alert. type: String - contextPath: CarbonBlackDefense.Alert.reason_code description: The reason code for the alert. type: String - contextPath: CarbonBlackDefense.Alert.threat_id description: The unique alert ID. type: String - contextPath: CarbonBlackDefense.Alert.primary_event_id description: The primary event ID related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.policy_applied description: The policy applied to the device when the alert was generated. type: String - contextPath: CarbonBlackDefense.Alert.run_state description: The run state of the alert. type: String - contextPath: CarbonBlackDefense.Alert.sensor_action description: The action taken by the sensor for the alert. type: String - contextPath: CarbonBlackDefense.Alert.workflow.change_timestamp description: The timestamp when the workflow status was last changed. type: Date - contextPath: CarbonBlackDefense.Alert.workflow.changed_by_type description: The type of user who last changed the workflow status. type: String - contextPath: CarbonBlackDefense.Alert.workflow.changed_by description: The user who last changed the workflow status. type: String - contextPath: CarbonBlackDefense.Alert.workflow.closure_reason description: The reason for closing the alert. type: String - contextPath: CarbonBlackDefense.Alert.workflow.status description: The current workflow status of the alert. type: String - contextPath: CarbonBlackDefense.Alert.determination.change_timestamp description: The timestamp when the determination was last changed. type: Date - contextPath: CarbonBlackDefense.Alert.determination.value description: The value of the determination. type: String - contextPath: CarbonBlackDefense.Alert.determination.changed_by_type description: The type of user who last changed the determination. type: String - contextPath: CarbonBlackDefense.Alert.determination.changed_by description: The user who last changed the determination. type: String - contextPath: CarbonBlackDefense.Alert.tags description: The tags associated with the alert. type: Unknown - contextPath: CarbonBlackDefense.Alert.alert_notes_present description: Indicates whether alert notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.threat_notes_present description: Indicates whether threat notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.alert_origin description: The origin of the alert. type: String - contextPath: CarbonBlackDefense.Alert.is_updated description: Indicates whether the alert has been updated. type: Boolean - contextPath: CarbonBlackDefense.Alert.device_id description: The device ID related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.device_name description: The name of the device related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.device_uem_id description: The Unified Endpoint Management (UEM) ID of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_target_value description: The target value of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_policy description: The policy applied to the device. type: String - contextPath: CarbonBlackDefense.Alert.device_policy_id description: The policy ID applied to the device. type: Number - contextPath: CarbonBlackDefense.Alert.device_os description: The operating system of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_os_version description: The operating system version of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_username description: The username associated with the device. type: String - contextPath: CarbonBlackDefense.Alert.device_location description: The location of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_external_ip description: The external IP address of the device. type: String - contextPath: CarbonBlackDefense.Alert.device_internal_ip description: The internal IP address of the device. type: String - contextPath: CarbonBlackDefense.Alert.asset_group description: The asset group to which the device belongs. type: Unknown - contextPath: CarbonBlackDefense.Alert.mdr_alert description: Indicates whether the alert is an MDR (Managed Detection and Response) alert. type: Boolean - contextPath: CarbonBlackDefense.Alert.mdr_alert_notes_present description: Indicates whether MDR alert notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.mdr_threat_notes_present description: Indicates whether MDR threat notes are present. type: Boolean - contextPath: CarbonBlackDefense.Alert.report_id description: The report ID associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.report_name description: The name of the report associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.report_tags description: The tags associated with the report. type: Unknown - contextPath: CarbonBlackDefense.Alert.ioc_id description: The indicator of compromise (IOC) ID related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.ioc_hit description: The IOC hit associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.watchlists.id description: The watchlist ID associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.watchlists.name description: The name of the watchlist associated with the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_guid description: The GUID of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_pid description: The PID of the process related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.process_name description: The name of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_sha256 description: The SHA-256 hash of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_md5 description: The MD5 hash of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_effective_reputation description: The effective reputation of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_reputation description: The reputation of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_cmdline description: The command line of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_username description: The username associated with the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_issuer description: The issuer of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.process_publisher description: The publisher of the process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_guid description: The GUID of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_pid description: The PID of the parent process related to the alert. type: Number - contextPath: CarbonBlackDefense.Alert.parent_name description: The name of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_sha256 description: The SHA-256 hash of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_md5 description: The MD5 hash of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_effective_reputation description: The effective reputation of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_reputation description: The reputation of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_cmdline description: The command line of the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.parent_username description: The username associated with the parent process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_guid description: The GUID of the child process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_username description: The username associated with the child process related to the alert. type: String - contextPath: CarbonBlackDefense.Alert.childproc_cmdline description: The command line of the child process related to the alert. type: String - name: cbd-get-policy arguments: - name: policyId description: The policy ID. required: true description: Retrieves a policy object by ID. outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for automatically deregistering inactive VDI (Virtual Desktop Infrastructure) devices. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for automatically deregistering inactive VM (Virtual Machine) workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates whether the Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay in milliseconds for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size in bytes that can be uploaded to Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level assigned by Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates whether the on-access scan is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of the on-access scan. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates whether the on-demand scan is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile used for the on-demand scan. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates whether the on-demand scan includes CD/DVD drives. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates whether the on-demand scan includes USB drives. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for scheduling the on-demand scan. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates whether a recovery scan is performed if the scheduled scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for scheduling the on-demand scan. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates whether signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for scheduling signature updates. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for scheduling signature updates. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for scheduling signature updates. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The update servers used for offsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates whether the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The update server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates whether the update servers override the default settings. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates whether file uploads are allowed by the directory action rule. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The directory path specified by the action rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates whether protection is enabled for the directory action rule. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates whether the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The unique rule configuration ID. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: The source from which the rule configuration is inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_network_data_collection description: Indicates whether network data collection is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_auth_events description: Indicates whether authentication events are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.WindowsAssignmentMode description: The Windows assignment mode for the rule configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configuration. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.action description: The default action of the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_access_check_guid description: The access check GUID for the default rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_inbound_event_check_guid description: The inbound event check GUID for the default rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.default_rule.default_rule_outbound_event_check_guid description: The outbound event check GUID for the default rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_host_based_firewall description: Indicates whether the host-based firewall is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.description description: A description of the rule group. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.name description: The name of the rule group. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.action description: The action specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.application_path description: The application path specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.direction description: The direction (inbound or outbound) specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.enabled description: Indicates whether the rule is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.local_ip_address description: The local IP address specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.local_port_ranges description: The local port ranges specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.name description: The name of the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.network_profile description: The network profile specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.protocol description: The protocol specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.remote_ip_address description: The remote IP address specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.remote_port_ranges description: The remote port ranges specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_access_check_guid description: The access check GUID for the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_inbound_event_check_guid description: The inbound event check GUID for the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.rule_outbound_event_check_guid description: The outbound event check GUID for the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.test_mode description: Indicates whether the rule is in test mode. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.rules.threat_score description: The threat score assigned by the rule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.rule_groups.ruleset_id description: The ID of the rule set. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates whether the UBS (User Behavior Settings) opt-in is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates whether prevalent module event collection is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The unique rule ID. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified by the rule. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates whether the rule is required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The unique sensor configuration ID. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: The source from which the sensor configuration is inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode specified by the sensor configuration. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor setting. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor setting. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The last update time of the policy. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-get-policies-summary description: Get an overview of the policies available in the organization. outputs: - contextPath: CarbonBlackDefense.PolicySummary.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.PolicySummary.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.PolicySummary.is_system description: Indicates whether the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.PolicySummary.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.PolicySummary.num_devices description: The number of devices currently using the policy. type: Number - contextPath: CarbonBlackDefense.PolicySummary.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.PolicySummary.priority_level description: The priority level of the policy. type: String - contextPath: CarbonBlackDefense.PolicySummary.total_num_devices description: The total number of devices associated with the policy. type: Number - name: cbd-create-policy arguments: - name: description description: A description of the policy. Can be multiple lines. - name: name description: A unique one-line name for the policy. - name: priorityLevel description: 'The priority score associated with sensors assigned to this policy. Possible values: "MISSION_CRITICAL", "HIGH", "MEDIUM", and "LOW".' auto: PREDEFINED predefined: - MISSION_CRITICAL - HIGH - MEDIUM - LOW - name: policy description: The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy's fields with the set-policy command, and pass the edited object. required: true description: Creates a new policy on the CB Defense backend. outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for auto-deregistering inactive VDI. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for auto-deregistering inactive VM workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates if Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates if on-access scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of on-access scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates if on-demand scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile for on-demand scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates if on-demand scanning of CD/DVD is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates if on-demand scanning of USB devices is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates if a recovery scan is scheduled if the previous scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates if signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The servers used for offsite devices for updates. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates if the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates if server overrides are enabled for updates. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates if file upload is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The path for directory action rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates if protection is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates if the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.description description: A description of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.id description: The ID of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from description: Indicates the source from which the rapid configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.name description: The name of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection description: Indicates if network data collection is enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events description: Indicates if authentication events are enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode description: The inline blocking mode for rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The ID of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: Indicates the source from which the rule configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configurations. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates if UBS opt-in is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates if prevalent module event collection is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The ID of the rules. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates if the rules are required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The ID of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: Indicates the source from which the sensor configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode for sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The time when the policy was last updated. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-update-policy arguments: - name: description description: A description of the policy. Can be multiple lines. - name: name description: A unique one-line name for the policy. - name: priorityLevel description: 'The priority score associated with sensors assigned to this policy. Possible values: "MISSION_CRITICAL", "HIGH", "MEDIUM", and "LOW".' auto: PREDEFINED predefined: - MISSION_CRITICAL - HIGH - MEDIUM - LOW - name: id description: The policy ID to update. required: true - name: policy description: The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy's fields with the set-policy command, and pass the edited object. required: true description: Update an existing policy on the CB Defense backend. outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for auto-deregistering inactive VDI. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for auto-deregistering inactive VM workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates if Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates if on-access scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of on-access scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates if on-demand scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile for on-demand scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates if on-demand scanning of CD/DVD is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates if on-demand scanning of USB devices is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates if a recovery scan is scheduled if the previous scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates if signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The servers used for offsite devices for updates. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates if the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates if server overrides are enabled for updates. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates if file upload is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The path for directory action rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates if protection is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates if the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.description description: A description of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.id description: The ID of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from description: Indicates the source from which the rapid configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.name description: The name of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection description: Indicates if network data collection is enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events description: Indicates if authentication events are enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode description: The inline blocking mode for rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The ID of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: Indicates the source from which the rule configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configurations. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates if UBS opt-in is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates if prevalent module event collection is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The ID of the rules. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates if the rules are required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The ID of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: Indicates the source from which the sensor configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode for sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The time when the policy was last updated. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-set-policy arguments: - name: policy description: The policy ID to set. required: true - name: keyValue description: The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy's fields with the set-policy command, and pass the edited object. required: true description: Set existing policy's fields on the CB Defense backend. outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for auto-deregistering inactive VDI. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for auto-deregistering inactive VM workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates if Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates if on-access scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of on-access scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates if on-demand scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile for on-demand scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates if on-demand scanning of CD/DVD is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates if on-demand scanning of USB devices is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates if a recovery scan is scheduled if the previous scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates if signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The servers used for offsite devices for updates. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates if the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates if server overrides are enabled for updates. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates if file upload is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The path for directory action rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates if protection is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates if the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.description description: A description of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.id description: The ID of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from description: Indicates the source from which the rapid configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.name description: The name of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection description: Indicates if network data collection is enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events description: Indicates if authentication events are enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode description: The inline blocking mode for rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The ID of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: Indicates the source from which the rule configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configurations. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates if UBS opt-in is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates if prevalent module event collection is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The ID of the rules. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates if the rules are required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The ID of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: Indicates the source from which the sensor configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode for sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The time when the policy was last updated. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-delete-policy arguments: - name: policyId description: The policy ID. required: true description: 'Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.' - name: cbd-add-rule-to-policy arguments: - name: action auto: PREDEFINED description: 'Rule action. Possible values: "TERMINATE", "IGNORE", "TERMINATE_THREAD", "ALLOW", "DENY, and "TERMINATE_PROCESS".' predefined: - TERMINATE - IGNORE - TERMINATE_THREAD - ALLOW - DENY - TERMINATE_PROCESS required: true - name: operation auto: PREDEFINED description: Rule operation. predefined: - BYPASS_ALL - BYPASS_API - INVOKE_SCRIPT - INVOKE_SYSAPP - POL_INVOKE_NOT_TRUSTED - INVOKE_CMD_INTERPRETER - RANSOM - NETWORK - CODE_INJECTION - PROCESS_ISOLATION - MEMORY_SCRAPE - RUN_INMEMORY_CODE - ESCALATE - RUN required: true - name: required auto: PREDEFINED description: 'Whether the rule is required.' predefined: - 'true' - 'false' required: true - name: type auto: PREDEFINED description: 'Application type. Possible values: "REPUTATION", "SIGNED_BY", and "NAME_PATH".' predefined: - REPUTATION - SIGNED_BY - NAME_PATH required: true - name: value description: Application value. predefined: - ADWARE, - COMMON_WHITE_LIST, - COMPANY_BLACK_LIST, - COMPANY_WHITE_LIST, - HEURISTIC, - IGNORE, - KNOWN_MALWARE, - LOCAL_WHITE, - NOT_LISTED, - PUP, - RESOLVING, - SUSPECT_MALWARE, - TRUSTED_WHITE_LIST required: true - name: policyId description: The policy ID. required: true description: 'Adds a new rule to an existing policy. Note: System policies cannot be modified.' outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for auto-deregistering inactive VDI. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for auto-deregistering inactive VM workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates if Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates if on-access scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of on-access scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates if on-demand scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile for on-demand scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates if on-demand scanning of CD/DVD is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates if on-demand scanning of USB devices is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates if a recovery scan is scheduled if the previous scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates if signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The servers used for offsite devices for updates. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates if the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates if server overrides are enabled for updates. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates if file upload is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The path for directory action rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates if protection is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates if the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.description description: A description of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.id description: The ID of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from description: Indicates the source from which the rapid configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.name description: The name of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection description: Indicates if network data collection is enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events description: Indicates if authentication events are enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode description: The inline blocking mode for rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The ID of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: Indicates the source from which the rule configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configurations. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates if UBS opt-in is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates if prevalent module event collection is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The ID of the rules. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates if the rules are required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The ID of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: Indicates the source from which the sensor configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode for sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The time when the policy was last updated. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-update-rule-in-policy arguments: - name: action auto: PREDEFINED description: 'Rule action. Possible values: "TERMINATE", "IGNORE", "TERMINATE_THREAD", "ALLOW", "DENY", and "TERMINATE_PROCESS".' predefined: - TERMINATE - IGNORE - TERMINATE_THREAD - ALLOW - DENY - TERMINATE_PROCESS required: true - name: operation auto: PREDEFINED description: Rule operation. predefined: - BYPASS_ALL - BYPASS_API - INVOKE_SCRIPT - INVOKE_SYSAPP - POL_INVOKE_NOT_TRUSTED - INVOKE_CMD_INTERPRETER - RANSOM - NETWORK - CODE_INJECTION - PROCESS_ISOLATION - MEMORY_SCRAPE - RUN_INMEMORY_CODE - ESCALATE - RUN required: true - name: required auto: PREDEFINED description: 'Whether the rule is required.' predefined: - 'true' - 'false' required: true - name: id description: Rule ID. required: true - name: type auto: PREDEFINED description: 'Application type. Possible values: "REPUTATION", "SIGNED_BY", and "NAME_PATH".' predefined: - REPUTATION - SIGNED_BY - NAME_PATH required: true - name: value description: Application value. predefined: - ADWARE, - COMMON_WHITE_LIST, - COMPANY_BLACK_LIST, - COMPANY_WHITE_LIST, - HEURISTIC, - IGNORE, - KNOWN_MALWARE, - LOCAL_WHITE, - NOT_LISTED, - PUP, - RESOLVING, - SUSPECT_MALWARE, - TRUSTED_WHITE_LIST required: true - name: policyId description: The policy ID. required: true description: 'Updates an existing rule with a new rule. Note: System policies cannot be modified.' outputs: - contextPath: CarbonBlackDefense.Policy.description description: A brief summary or description of the policy. type: String - contextPath: CarbonBlackDefense.Policy.id description: The unique policy ID. type: Number - contextPath: CarbonBlackDefense.Policy.name description: The name of the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vdi_interval_ms description: The interval in milliseconds for auto-deregistering inactive VDI. type: Number - contextPath: CarbonBlackDefense.Policy.policy.auto_deregister_inactive_vm_workloads_interval_ms description: The interval in milliseconds for auto-deregistering inactive VM workloads. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.enabled description: Indicates if Avira Protection Cloud is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_exe_delay description: The maximum execution delay for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.max_file_size description: The maximum file size for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.avira_protection_cloud.risk_level description: The risk level for Avira Protection Cloud. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.enabled description: Indicates if on-access scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_access_scan.mode description: The mode of on-access scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.enabled description: Indicates if on-demand scanning is enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.profile description: The profile for on-demand scanning. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_cd_dvd description: Indicates if on-demand scanning of CD/DVD is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.scan_usb description: Indicates if on-demand scanning of USB devices is enabled. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.range_hours description: The range of hours for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.recovery_scan_if_missed description: Indicates if a recovery scan is scheduled if the previous scan is missed. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.on_demand_scan.schedule.start_hour description: The start hour for the on-demand scan schedule. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.enabled description: Indicates if signature updates are enabled. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.full_interval_hours description: The full interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.initial_random_delay_hours description: The initial random delay in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.signature_update.schedule.interval_hours description: The interval in hours for signature update scheduling. type: Number - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_offsite_devices description: The servers used for offsite devices for updates. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.preferred description: Indicates if the server is preferred for onsite devices. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_for_onsite_devices.server description: The server used for onsite devices. type: String - contextPath: CarbonBlackDefense.Policy.policy.av_settings.update_servers.servers_override description: Indicates if server overrides are enabled for updates. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.file_upload description: Indicates if file upload is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.path description: The path for directory action rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.directory_action_rules.protection description: Indicates if protection is enabled for directory action rules. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.is_system description: Indicates if the policy is a system policy. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.org_key description: The organization key associated with the policy. type: String - contextPath: CarbonBlackDefense.Policy.policy.position description: The position of the policy in the list of policies. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.description description: A description of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.id description: The ID of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.inherited_from description: Indicates the source from which the rapid configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.name description: The name of the rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_network_data_collection description: Indicates if network data collection is enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.enable_auth_events description: Indicates if authentication events are enabled in rapid configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rapid_configs.parameters.inline_blocking_mode description: The inline blocking mode for rapid configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.category description: The category of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.description description: A description of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.id description: The ID of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.inherited_from description: Indicates the source from which the rule configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.name description: The name of the rule configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters description: The parameters of the rule configurations. type: Unknown - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.ubs_opt_in description: Indicates if UBS opt-in is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rule_configs.parameters.enable_prevalent_module_event_collection description: Indicates if prevalent module event collection is enabled in rule configurations. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.id description: The ID of the rules. type: Number - contextPath: CarbonBlackDefense.Policy.policy.rules.required description: Indicates if the rules are required. type: Boolean - contextPath: CarbonBlackDefense.Policy.policy.rules.action description: The action specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.type description: The type of application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.application.value description: The value of the application specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.rules.operation description: The operation specified in the rules. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.category description: The category of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.description description: A description of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.id description: The ID of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.inherited_from description: Indicates the source from which the sensor configurations are inherited. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.name description: The name of the sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_configs.parameters.inline_blocking_mode description: The inline blocking mode for sensor configurations. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.name description: The name of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.sensor_settings.value description: The value of the sensor settings. type: String - contextPath: CarbonBlackDefense.Policy.policy.update_time description: The time when the policy was last updated. type: Date - contextPath: CarbonBlackDefense.Policy.priorityLevel description: The priority level of the policy. type: String - name: cbd-delete-rule-from-policy arguments: - name: policyId description: The policy ID. required: true - name: ruleId description: The rule ID. required: true description: 'Removes a rule from an existing policy. Note: System policies cannot be modified.' - name: cbd-find-processes arguments: - name: polling auto: PREDEFINED defaultValue: "yes" predefined: - "yes" - "no" description: When set to "no", the function will not use polling and will return the process job ID. - name: job_id hidden: true description: 'The unique process search job ID. This ID is used to retrieve the results of the process search initiated by the Carbon Black Cloud. If not provided, a new search job will be created based on the other provided arguments.' - name: alert_category auto: PREDEFINED description: 'The Carbon Black Cloud classification for events tagged to an alert. Possible values: "THREAT" and "OBSERVED".' predefined: - THREAT - OBSERVED - name: device_external_ip description: The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. - name: device_id description: The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. - name: device_internal_ip description: The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. - name: device_name description: The hostname of the endpoint recorded by the sensor when last initialized. - name: device_os auto: PREDEFINED description: 'The operating system of the endpoint. Possible values: "WINDOWS", "MAC", "LINUX".' predefined: - WINDOWS - MAC - LINUX - name: device_timestamp description: 'The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z.' - name: event_type auto: PREDEFINED description: 'The type of enriched event observed. Possible value: "filemod", "netconn", "regmod", "modload", "crossproc", "childproc", "scriptload", and "fileless_scriptload".' predefined: - filemod - netconn - regmod - modload - crossproc - childproc - scriptload - fileless_scriptload - name: parent_name description: The file system path of the parent process binary. - name: parent_reputation auto: PREDEFINED description: 'The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".' predefined: - ADAPTIVE_WHITE_LIST - ADWARE - COMMON_WHITE_LIST - COMPANY_BLACK_LIST - COMPANY_WHITE_LIST - HEURISTIC - IGNORE - KNOWN_MALWARE - LOCAL_WHITE - NOT_LISTED - PUP - RESOLVING - SUSPECT_MALWARE - TRUSTED_WHITE_LIST - name: process_cmdline description: The command line executed by the actor process. - name: process_guid description: The unique process ID for the the actor process. - name: hash description: Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). - name: process_name description: The file system path of the actor process binary. - name: process_pid description: The process ID assigned by the operating system. This can be multi-valued for fork() or exec() process operations on Linux and macOS. - name: process_reputation auto: PREDEFINED description: 'The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".' predefined: - ADAPTIVE_WHITE_LIST - ADWARE - COMMON_WHITE_LIST - COMPANY_BLACK_LIST - COMPANY_WHITE_LIST - HEURISTIC - IGNORE - KNOWN_MALWARE - LOCAL_WHITE - NOT_LISTED - PUP - RESOLVING - SUSPECT_MALWARE - TRUSTED_WHITE_LIST - name: process_start_time description: 'The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts.' - name: process_terminated auto: PREDEFINED description: 'Whether the process has terminated. Always "false" for enriched events (process termination not recorded).' predefined: - 'true' - 'false' - name: process_username description: |- The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). - name: sensor_action auto: PREDEFINED description: 'The action performed by the sensor on the process. Possible values: "TERMINATE", "DENY", and "SUSPEND".' predefined: - TERMINATE - DENY - SUSPEND - name: query description: The query in Lucene syntax and/or value searches. - name: rows description: The number of rows to request. - name: start description: The first row to use for pagination. - name: time_range description: 'The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp.' - name: interval_in_seconds description: Used for polling. - name: time_out description: Used for polling. description: 'Creates a process search job and retrieves the search results. At least one of the arguments (not including: rows, start, and time_range) is required.' polling: true outputs: - contextPath: CarbonBlackDefense.Process.job_id description: The process job id when polling set to false. type: String - contextPath: CarbonBlackDefense.Process.Results.backend_timestamp description: The timestamp when the process data was collected from the backend. type: Date - contextPath: CarbonBlackDefense.Process.Results.childproc_count description: The number of child processes spawned by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.crossproc_count description: The number of cross-process interactions involving the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_id description: The unique ID of the device where the process is running. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_name description: The name of the device where the process is running. type: String - contextPath: CarbonBlackDefense.Process.Results.device_policy_id description: The policy ID associated with the device. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_timestamp description: The timestamp when the process data was collected from the device. type: Date - contextPath: CarbonBlackDefense.Process.Results.filemod_count description: The number of file modifications made by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.index_class description: The classification of the process based on indexing. type: String - contextPath: CarbonBlackDefense.Process.Results.modload_count description: The number of modules loaded by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.netconn_count description: The number of network connections established by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.org_id description: The organization ID associated with the process. type: String - contextPath: CarbonBlackDefense.Process.Results.parent_guid description: The GUID of the parent process. type: String - contextPath: CarbonBlackDefense.Process.Results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackDefense.Process.Results.partition_id description: The partition ID associated with the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.process_guid description: The GUID of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_hash description: The hash of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_name description: The name of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_pid description: The PID of the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.process_username description: The username under which the process is running. type: String - contextPath: CarbonBlackDefense.Process.Results.regmod_count description: The number of registry modifications made by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.scriptload_count description: The number of scripts loaded by the process. type: Number - name: cbd-find-observation-details arguments: - name: polling auto: PREDEFINED defaultValue: true predefined: - "yes" - "no" description: When set to false, the function will not use polling and will return the process job ID. - name: job_id hidden: true description: The ID of the job to retrieve the details. This is used internally for polling. - name: alert_id description: The ID of the alert to retrieve the observation details. Must be specified alone. - name: observation_ids description: A list of observation IDs to retrieve the details. Must be specified alone. - name: event_ids hidden: true description: Functioning the same as `observation_ids`. This argument is retained for backward compatibility to ensure existing implementations continue to work without changes. - name: process_hash description: The hash of the process to search for. Can be combined with rows, and with device_id or count_unique_devices, but not both. - name: device_id description: The ID of the device to filter the observations. Must be combined with process_hash. Cannot be combined with alert_id, observation_ids, count_unique_devices. - name: count_unique_devices description: A boolean indicating whether to count unique devices executing the process hash. Must be combined with process_hash. Cannot be combined with alert_id, observation_ids, device_id. - name: rows description: The maximum number of rows to return, up to 10,000. Can only be combined with process_hash. description: Fetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion. polling: true outputs: - contextPath: CarbonBlackDefense.EventDetails.job_id description: The process job id when polling set to false. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.alert_category description: The category of the alert associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.alert_id description: The unique ID of the alert associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.backend_timestamp description: The timestamp when the observation data was collected from the backend. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.childproc_count description: The number of child processes spawned by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.crossproc_count description: The number of cross-process interactions involving the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_external_ip description: The external IP address of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_group_id description: The group ID associated with the device. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_id description: The unique ID of the device where the observation was made. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_installed_by description: The user or process that installed the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_internal_ip description: The internal IP address of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_location description: The physical or network location of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_name description: The name of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_os description: The operating system of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_os_version description: The version of the operating system of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_policy description: The policy applied to the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_policy_id description: The unique ID of the policy applied to the device. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_sensor_version description: The version of the sensor installed on the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_target_priority description: The priority level of the device as a target. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_timestamp description: The timestamp when the observation was recorded on the device. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.document_guid description: The GUID of the document associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.enriched description: Indicates whether the observation data has been enriched with additional information. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.enriched_event_type description: The type of event after enrichment. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.event_threat_score description: The threat score associated with the event. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.filemod_count description: The number of file modifications made by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.ingress_time description: The time when the observation data was ingested into the system. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.legacy description: Indicates whether the observation is from a legacy system or data source. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.modload_count description: The number of modules loaded by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.netconn_count description: The number of network connections established by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.observation_description description: A description of the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.observation_id description: The unique observation ID. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.observation_type description: The type of observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.org_id description: The organization ID associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_cmdline description: The command line arguments of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_cmdline_length description: The length of the command line arguments of the parent process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.parent_effective_reputation description: The effective reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_effective_reputation_source description: The source of the effective reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_guid description: The GUID of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_hash description: The hash of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_name description: The name of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.parent_publisher description: The publisher of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_publisher_state description: The state of the publisher of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_reputation description: The reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_cmdline description: The command line arguments of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_cmdline_length description: The length of the command line arguments of the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.process_company_name description: The company name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_effective_reputation description: The effective reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_effective_reputation_source description: The source of the effective reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_elevated description: Indicates whether the observed process is running with elevated privileges. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.process_file_description description: The description of the observed process file. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_guid description: The GUID of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_hash description: The hash of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_integrity_level description: The integrity level of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_internal_name description: The internal name of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_name description: The name of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_original_filename description: The original filename of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_pid description: The PID of the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.process_privileges description: The privileges associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_product_name description: The product name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_product_version description: The product version associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_publisher description: The publisher of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_publisher_state description: The state of the publisher of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_reputation description: The reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_service_name description: The service name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_sha256 description: The SHA-256 hash. - name: cbd-find-observation arguments: - name: polling auto: PREDEFINED defaultValue: true predefined: - "yes" - "no" description: When set to false, the function will not use polling and will return the process job ID. - name: job_id hidden: true description: The ID of the job to retrieve the observation. This is used internally for polling. - name: alert_category auto: PREDEFINED description: 'The Carbon Black Cloud classification for events tagged to an alert. Possible values: "THREAT" and "OBSERVED".' predefined: - THREAT - OBSERVED - name: device_external_ip description: The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format. - name: device_id description: The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments. - name: device_internal_ip description: The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format. - name: device_name description: The hostname of the endpoint recorded by the sensor when last initialized. - name: device_os auto: PREDEFINED description: 'The operating system of the endpoint. Possible values: "WINDOWS", "MAC", "LINUX".' predefined: - WINDOWS - MAC - LINUX - name: device_timestamp description: 'The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z.' - name: event_type auto: PREDEFINED description: 'The type of enriched event observed. Possible value: "filemod", "netconn", "regmod", "modload", "crossproc", "childproc", "scriptload", and "fileless_scriptload".' predefined: - filemod - netconn - regmod - modload - crossproc - childproc - scriptload - fileless_scriptload - name: parent_name description: The file system path of the parent process binary. - name: parent_reputation auto: PREDEFINED description: 'The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".' predefined: - ADAPTIVE_WHITE_LIST - ADWARE - COMMON_WHITE_LIST - COMPANY_BLACK_LIST - COMPANY_WHITE_LIST - HEURISTIC - IGNORE - KNOWN_MALWARE - LOCAL_WHITE - NOT_LISTED - PUP - RESOLVING - SUSPECT_MALWARE - TRUSTED_WHITE_LIST - name: process_cmdline description: The command line executed by the actor process. - name: process_guid description: The unique process ID for the actor process. - name: hash description: Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash). - name: process_name description: The file system path of the actor process binary. - name: process_pid description: The process ID assigned by the operating system. This can be multi-valued for fork() or exec() process operations on Linux and macOS. - name: process_reputation auto: PREDEFINED description: 'The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".' predefined: - ADAPTIVE_WHITE_LIST - ADWARE - COMMON_WHITE_LIST - COMPANY_BLACK_LIST - COMPANY_WHITE_LIST - HEURISTIC - IGNORE - KNOWN_MALWARE - LOCAL_WHITE - NOT_LISTED - PUP - RESOLVING - SUSPECT_MALWARE - TRUSTED_WHITE_LIST - name: process_start_time description: 'The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts.' - name: process_terminated auto: PREDEFINED description: 'Whether the process has terminated. Possible values: "true" and "false". Always "false" for enriched events (process termination not recorded).' predefined: - 'true' - 'false' - name: process_username description: |- The user context in which the actor process was executed. MacOS - all users for the PID for fork() and exec() transitions. Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid(). - name: sensor_action auto: PREDEFINED description: 'The action performed by the sensor on the process. Possible values: "TERMINATE", "DENY", and "SUSPEND".' predefined: - TERMINATE - DENY - SUSPEND - name: query description: The query in Lucene syntax and/or value searches. - name: rows description: The number of rows to request. - name: start description: The first row to use for pagination. - name: time_range description: 'The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp.' - name: interval_in_seconds description: Used for polling. - name: time_out description: Used for polling. description: Fetches Carbon Black events details based on specified parameters. Supports polling to wait for the search job completion. polling: true outputs: - contextPath: CarbonBlackDefense.Events.job_id description: The process job id when polling set to false. type: String - contextPath: CarbonBlackDefense.Events.Results.alert_category description: 'Category of the alert associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.alert_id description: The unique alert ID. type: String - contextPath: CarbonBlackDefense.Events.Results.backend_timestamp description: 'Timestamp when the event was processed on the backend.' type: Date - contextPath: CarbonBlackDefense.Events.Results.childproc_count description: 'Number of child processes spawned by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.crossproc_count description: 'Number of cross-process operations performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.device_external_ip description: 'External IP address of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_group_id description: The device group ID. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_id description: The unique device ID. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_installed_by description: 'User or entity that installed the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_internal_ip description: 'Internal IP address of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_location description: 'Physical or network location of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_name description: 'Name of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_os description: 'Operating system running on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_os_version description: 'Version of the operating system running on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_policy description: 'Security policy applied to the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_policy_id description: The the security policy ID applied to the device. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_sensor_version description: 'Version of the sensor installed on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_target_priority description: 'Priority of the device as a target.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_timestamp description: 'Timestamp of the event as recorded by the device.' type: Date - contextPath: CarbonBlackDefense.Events.Results.document_guid description: The global unique ID for the document associated with the event. type: String - contextPath: CarbonBlackDefense.Events.Results.enriched description: 'Indicates whether the event data has been enriched.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.enriched_event_type description: 'Type of the enriched event.' type: String - contextPath: CarbonBlackDefense.Events.Results.event_threat_score description: 'Threat score assigned to the event.' type: Number - contextPath: CarbonBlackDefense.Events.Results.filemod_count description: 'Number of file modifications performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.ingress_time description: 'Time when the event was ingested by the system.' type: Date - contextPath: CarbonBlackDefense.Events.Results.legacy description: 'Indicates whether the event is considered a legacy event.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.modload_count description: 'Number of modules loaded by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.netconn_count description: 'Number of network connections established by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.observation_description description: 'Description of the observation associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.observation_id description: The unique observation ID. type: String - contextPath: CarbonBlackDefense.Events.Results.observation_type description: 'Type of the observation associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.org_id description: The organization ID associated with the event. type: String - contextPath: CarbonBlackDefense.Events.Results.parent_cmdline description: 'Command line used to execute the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_cmdline_length description: 'Length of the command line used to execute the parent process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.parent_effective_reputation description: 'Effective reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_effective_reputation_source description: 'Source of the effective reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_guid description: The global unique ID for the parent process. type: String - contextPath: CarbonBlackDefense.Events.Results.parent_hash description: 'Hash of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_name description: 'Name of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_pid description: The parent process ID. type: Number - contextPath: CarbonBlackDefense.Events.Results.parent_publisher description: 'Publisher of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_publisher_state description: 'Publisher state of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_reputation description: 'Reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_cmdline description: 'Command line used to execute the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_cmdline_length description: 'Length of the command line used to execute the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.process_company_name description: 'Company name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_effective_reputation description: 'Effective reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_effective_reputation_source description: 'Source of the effective reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_elevated description: 'Indicates whether the process is running with elevated privileges.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.process_file_description description: 'File description of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_guid description: The global unique process ID. type: String - contextPath: CarbonBlackDefense.Events.Results.process_hash description: 'Hash of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_integrity_level description: 'Integrity level of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_internal_name description: 'Internal name of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_name description: 'Name of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_original_filename description: 'Original filename of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_pid description: The process ID of the process. type: Number - contextPath: CarbonBlackDefense.Events.Results.process_privileges description: 'Privileges associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_product_name description: 'Product name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_product_version description: 'Product version associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_publisher description: 'Publisher of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_publisher_state description: 'Publisher state of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_reputation description: 'Reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_service_name description: 'Service name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_sha256 description: 'SHA-256 hash of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_start_time description: 'Start time of the process.' type: Date - contextPath: CarbonBlackDefense.Events.Results.process_username description: 'Username under which the process is running.' type: String - contextPath: CarbonBlackDefense.Events.Results.regmod_count description: 'Number of registry modifications performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.scriptload_count description: 'Number of scripts loaded by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.sensor_action description: 'Action taken by the sensor for the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.ttp description: 'Tactics, techniques, and procedures associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.watchlist_hit description: 'Indicates if the event matches a watchlist entry.' type: String - name: cbd-device-search arguments: - name: device_id description: The device ID. - name: os auto: PREDEFINED description: 'The operating system. Possible values: "WINDOWS", "MAC", "LINUX", and "OTHER".' predefined: - WINDOWS - MAC - LINUX - OTHER - name: status auto: PREDEFINED description: 'The status of the device. Possible values: "PENDING", "REGISTERED", "DEREGISTERED", "BYPASS", "ACTIVE", "INACTIVE", "ERROR", "ALL", "BYPASS_ON", "LIVE", "SENSOR_PENDING_UPDATE".' predefined: - PENDING - REGISTERED - DEREGISTERED - BYPASS - ACTIVE - INACTIVE - ERROR - ALL - BYPASS_ON - LIVE - SENSOR_PENDING_UPDATE - name: start_time description: 'The time to start getting results. specified as ISO-8601 strings for example: "2021-01-27T12:43:26.243Z".' - name: target_priority auto: PREDEFINED description: 'The “Target value” configured in the policy assigned to the sensor. Possible values: "LOW", "MEDIUM", "HIGH", "MISSION_CRITICAL".' predefined: - LOW - MEDIUM - HIGH - MISSION_CRITICAL - name: query description: The query in Lucene syntax and/or value searches. - name: end_time description: 'The time to stop getting results. specified as ISO-8601 strings for example: "2021-02-27T12:43:26.243Z".' - name: rows defaultValue: '20' description: The maximum number of rows to return. Default is 20. description: Searches devices in your organization. outputs: - contextPath: CarbonBlackDefense.Device.activation_code description: The device activation code to register the sensor with a specific organization. type: String - contextPath: CarbonBlackDefense.Device.activation_code_expiry_time description: The time when the activation code expires and cannot be used to register a device. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.ad_group_id description: The Active Directory group ID to match. type: Number - contextPath: CarbonBlackDefense.Device.appliance_name description: The name of the appliance the Virtual Machine (VM) is associated with. type: String - contextPath: CarbonBlackDefense.Device.appliance_uuid description: The UUID of the appliance the VM is associated with. type: String - contextPath: CarbonBlackDefense.Device.av_ave_version description: The AVE version (part of AV Version). type: String - contextPath: CarbonBlackDefense.Device.av_engine description: The current antivirus (AV) version. type: String - contextPath: CarbonBlackDefense.Device.av_last_scan_time description: The last time a local scan completed. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.av_master description: Whether the device is an AV Master. type: Boolean - contextPath: CarbonBlackDefense.Device.av_pack_version description: The pack version (part of AV version). type: String - contextPath: CarbonBlackDefense.Device.av_product_version description: The product version (part of AV version). type: String - contextPath: CarbonBlackDefense.Device.av_status description: The status of the local scan. For example [ "AV_ACTIVE", "AV_REGISTERED" ]. (AV_NOT_REGISTERED, AV_REGISTERED, AV_DEREGISTERED, AV_ACTIVE, AV_BYPASS, SIGNATURE_UPDATE_DISABLED, ONACCESS_SCAN_DISABLED, ONDEMAND_SCAN_DISABLED, PRODUCT_UPDATE_DISABLED). type: String - contextPath: CarbonBlackDefense.Device.av_update_servers description: A list of the device’s AV servers. For example [ "string", "string" ]. type: Unknown - contextPath: CarbonBlackDefense.Device.av_vdf_version description: VDF version (part of AV version). type: String - contextPath: CarbonBlackDefense.Device.cluster_name description: Name of the cluster. A cluster is a group of hosts. type: String - contextPath: CarbonBlackDefense.Device.current_sensor_policy_name description: The name of the policy currently configured on the sensor. type: String - contextPath: CarbonBlackDefense.Device.datacenter_name description: The name of the underlying data center. The data center managed object provides the interface to the common container object for hosts, virtual machines, networks, and datastores. type: String - contextPath: CarbonBlackDefense.Device.deployment_type description: The device’s deployment type. This is a classification that is determined by its lifecycle management policy. (ENDPOINT, WORKLOAD). type: String - contextPath: CarbonBlackDefense.Device.deregistered_time description: The time when the deregister request was received. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.key_name description: The key name that describes the device. type: String - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.key_value description: The key value that describes the device. type: String - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.position description: The position that describes the device. type: Number - contextPath: CarbonBlackDefense.Device.device_owner_id description: The ID of the device owner associated with the device. type: Number - contextPath: CarbonBlackDefense.Device.email description: The email address for the device owner. type: String - contextPath: CarbonBlackDefense.Device.encoded_activation_code description: The encoded activation code. type: String - contextPath: CarbonBlackDefense.Device.esx_host_name description: The name of the ESX host on which the VM is deployed. type: String - contextPath: CarbonBlackDefense.Device.esx_host_uuid description: The UUID of the ESX host on which the VM is deployed. type: String - contextPath: CarbonBlackDefense.Device.first_name description: The first name of the device owner. type: String - contextPath: CarbonBlackDefense.Device.id description: The ID of the device. type: Number - contextPath: CarbonBlackDefense.Device.last_contact_time description: The last time the sensor contacted Carbon Black Cloud. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_device_policy_changed_time description: The last time the sensor changed from one policy to another. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_device_policy_requested_time description: The last time the sensor checked for changes to the policy. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_external_ip_address description: The last IP address of the device according to Carbon Black Cloud. This can differ from the last_internal_ip_address due to the network proxy or NAT. Can be either IPv4 or IPv6 format. type: String - contextPath: CarbonBlackDefense.Device.last_internal_ip_address description: The last IP address of the device reported by the sensor. Can be either IPv4 or IPv6 format. type: String - contextPath: CarbonBlackDefense.Device.last_location description: The device’s current location relative to the organization’s network, based on the current IP address and the device’s registered DNS domain suffix. (UNKNOWN, ONSITE, OFFSITE). type: String - contextPath: CarbonBlackDefense.Device.last_name description: The last name of the device owner. type: String - contextPath: CarbonBlackDefense.Device.last_policy_updated_time description: The last time the current policy received an update. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_reported_time description: The last time Carbon Black Cloud received one or more events reported by the sensor. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_reset_time description: The last time the device was reset. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.last_shutdown_time description: The last time the device was shutdown. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.linux_kernel_version description: Not implemented. type: String - contextPath: CarbonBlackDefense.Device.login_user_name description: The last user who logged in to the device. (Requires Windows Carbon Black Cloud sensor). type: String - contextPath: CarbonBlackDefense.Device.mac_address description: The media access control (MAC) address for the device’s primary interface. (Requires Windows CBC sensor version 3.6.0.1941 or later, or macOS CBC sensor). type: String - contextPath: CarbonBlackDefense.Device.middle_name description: The middle name of the device owner. type: String - contextPath: CarbonBlackDefense.Device.name description: The hostname of the endpoint recorded by the sensor when last initialized. type: String - contextPath: CarbonBlackDefense.Device.organization_id description: The organization ID. type: Number - contextPath: CarbonBlackDefense.Device.organization_name description: The organization name. type: String - contextPath: CarbonBlackDefense.Device.os description: The operating system. (WINDOWS, MAC, LINUX, OTHER). type: String - contextPath: CarbonBlackDefense.Device.os_version description: The operating system and version of the endpoint. type: String - contextPath: CarbonBlackDefense.Device.passive_mode description: Whether the device is in bypass mode. type: Boolean - contextPath: CarbonBlackDefense.Device.policy_id description: The policy ID assigned to the device. type: Number - contextPath: CarbonBlackDefense.Device.policy_name description: The policy name assigned to the device. This name may not match the current_sensor_policy_name until the sensor checks back in. type: String - contextPath: CarbonBlackDefense.Device.policy_override description: Whether the policy was manually assigned to override mass sensor management. type: Boolean - contextPath: CarbonBlackDefense.Device.quarantined description: The indicator that the device is in quarantine mode. type: Boolean - contextPath: CarbonBlackDefense.Device.registered_time description: The time when the device was registered with Carbon Black Cloud. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.scan_last_action_time description: The last time the background scan was started or stopped. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.scan_last_complete_time description: The time the last background scan completed. (ISO 8601 timestamp in UTC). type: Date - contextPath: CarbonBlackDefense.Device.scan_status description: The status of the background scan. (NEVER_RUN, STOPPED, IN_PROGRESS, COMPLETED). type: String - contextPath: CarbonBlackDefense.Device.sensor_kit_type description: The type of sensor installed on the device. (XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX). type: String - contextPath: CarbonBlackDefense.Device.sensor_out_of_date description: Whether there is a new version available to be installed. type: Boolean - contextPath: CarbonBlackDefense.Device.sensor_pending_update description: Whether the sensor is marked by the sensor updater service for a sensor upgrade. type: Boolean - contextPath: CarbonBlackDefense.Device.sensor_states description: The states the sensor is in. For example [ "ACTIVE", "LIVE_RESPONSE_ENABLED" ]. (ACTIVE, PANICS_DETECTED, LOOP_DETECTED, DB_CORRUPTION_DETECTED, CSR_ACTION, REPUX_ACTION, DRIVER_INIT_ERROR, REMGR_INIT_ERROR, UNSUPPORTED_OS, SENSOR_UPGRADE_IN_PROGRESS, SENSOR_UNREGISTERED, WATCHDOG, SENSOR_RESET_IN_PROGRESS, DRIVER_INIT_REBOOT_REQUIRED, DRIVER_LOAD_NOT_GRANTED, SENSOR_SHUTDOWN, SENSOR_MAINTENANCE, FULL_DISK_ACCESS_NOT_GRANTED, DEBUG_MODE_ENABLED, AUTO_UPDATE_DISABLED, SELF_PROTECT_DISABLED, VDI_MODE_ENABLED, POC_MODE_ENABLED, SECURITY_CENTER_OPTLN_DISABLED, LIVE_RESPONSE_RUNNING, LIVE_RESPONSE_NOT_RUNNING, LIVE_RESPONSE_KILLED, LIVE_RESPONSE_NOT_KILLED, LIVE_RESPONSE_ENABLED, LIVE_RESPONSE_DISABLED, DRIVER_KERNEL, DRIVER_USERSPACE). type: String - contextPath: CarbonBlackDefense.Device.sensor_version description: 'The version of the installed sensor in the format: #.#.#.#.' type: String - contextPath: CarbonBlackDefense.Device.status description: The status of the device. (PENDING, REGISTERED, DEREGISTERED, BYPASS Additional searchable statuses that are not returnable ACTIVE, INACTIVE, ERROR, ALL, BYPASS_ON, LIVE, SENSOR_PENDING_UPDATE). type: String - contextPath: CarbonBlackDefense.Device.target_priority description: Device target priorities to match. (LOW, MEDIUM, HIGH, MISSION_CRITICAL). type: String - contextPath: CarbonBlackDefense.Device.uninstall_code description: The code to enter when uninstalling the sensor. type: String - contextPath: CarbonBlackDefense.Device.vcenter_host_url description: The vCenter host URL. type: String - contextPath: CarbonBlackDefense.Device.vcenter_name description: The name of the vCenter the VM is associated with. type: String - contextPath: CarbonBlackDefense.Device.vcenter_uuid description: The 128-bit SMBIOS UUID of a vCenter represented as a hexadecimal string. type: String - contextPath: CarbonBlackDefense.Device.vdi_base_device description: The ID of the device from which this device was cloned/re-registered. type: Number - contextPath: CarbonBlackDefense.Device.virtual_machine description: Whether this device is a virtual machine (VMware AppDefense integration). Deprecated for deployment_type. type: Boolean - contextPath: CarbonBlackDefense.Device.virtualization_provider description: The name of the VM virtualization provider. type: String - contextPath: CarbonBlackDefense.Device.vm_ip description: The IP address of the VM. type: String - contextPath: CarbonBlackDefense.Device.vm_name description: The name of the VM that the sensor is deployed on. type: String - contextPath: CarbonBlackDefense.Device.vm_uuid description: 'The 128-bit SMBIOS UUID of a virtual machine represented as a hexadecimal string. (Format: 12345678-abcd-1234-cdef-123456789abc).' type: String - contextPath: CarbonBlackDefense.Device.vulnerability_score description: The vulnerability score from 0 to 100 indicating the workload’s level of vulnerability with 100 being highly vulnerable. type: Number - contextPath: CarbonBlackDefense.Device.vulnerability_severity description: The severity level indicating the workload’s vulnerability. (CRITICAL, MODERATE, IMPORTANT, LOW). type: String - contextPath: CarbonBlackDefense.Device.windows_platform description: Deprecated for os_version. (CLIENT_X86, CLIENT_X64, SERVER_X86, SERVER_X64, CLIENT_ARM64, SERVER_ARM64). type: String - name: cbd-device-quarantine arguments: - name: device_id description: The ID of the device. required: true description: Quarantines the device. Not supported for devices in a Linux operating system. - name: cbd-device-unquarantine arguments: - name: device_id description: The ID of the device. required: true description: Unquarantines the device. Not supported for devices in a Linux operating system. - name: cbd-device-background-scan arguments: - name: device_id description: The ID of the device. required: true description: Starts a background scan on the device. Not supported for devices in a Linux operating system. - name: cbd-device-background-scan-stop arguments: - name: device_id description: The ID of the device. required: true description: Stops a background scan on the device. Not supported for devices in a Linux operating system. - name: cbd-device-bypass arguments: - name: device_id description: The ID of the device. required: true description: Bypasses a device. - name: cbd-device-unbypass arguments: - name: device_id description: The ID of the device. required: true description: Unbypasses a device. - name: cbd-device-policy-update arguments: - name: device_id description: The ID of the device. required: true - name: policy_id description: The ID of the policy. required: true description: Updates the devices to the specified policy ID. - name: cbd-device-update-sensor-version arguments: - name: device_id description: The ID of the device. required: true - name: sensor_version description: 'The new version of the sensor. For example: { "MAC": "1.2.3.4" }. Supported types: XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX.' predefined: - '{"XP":}' - '{"WINDOWS":}' - '{"MAC":}' - '{"AV_SIG":}' - '{"OTHER":}' - '{"RHEL":}' - '{"UBUNTU":}' - '{"SUSE":}' - '{"AMAZON_LINUX":}' - '{"MAC_OSX":}' required: true description: Updates the version of a sensor. - name: cbd-find-processes-results arguments: - name: polling defaultValue: false hidden: true description: 'When set to false, the function will not use polling and will return the process status or the result if the process is complete.' - name: job_id required: true description: 'The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud.' - name: rows description: The number of rows to request. description: 'Retrieves the search results using the specified job ID.' polling: true outputs: - contextPath: CarbonBlackDefense.Process.Results.backend_timestamp description: The timestamp when the process data was collected from the backend. type: Date - contextPath: CarbonBlackDefense.Process.Results.childproc_count description: The number of child processes spawned by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.crossproc_count description: The number of cross-process interactions involving the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_id description: The unique ID of the device where the process is running. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_name description: The name of the device where the process is running. type: String - contextPath: CarbonBlackDefense.Process.Results.device_policy_id description: The policy ID associated with the device. type: Number - contextPath: CarbonBlackDefense.Process.Results.device_timestamp description: The timestamp when the process data was collected from the device. type: Date - contextPath: CarbonBlackDefense.Process.Results.filemod_count description: The number of file modifications made by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.index_class description: The classification of the process based on indexing. type: String - contextPath: CarbonBlackDefense.Process.Results.modload_count description: The number of modules loaded by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.netconn_count description: The number of network connections established by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.org_id description: The organization ID associated with the process. type: String - contextPath: CarbonBlackDefense.Process.Results.parent_guid description: The GUID of the parent process. type: String - contextPath: CarbonBlackDefense.Process.Results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackDefense.Process.Results.partition_id description: The partition ID associated with the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.process_guid description: The GUID of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_hash description: The hash of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_name description: The name of the process. type: String - contextPath: CarbonBlackDefense.Process.Results.process_pid description: The PID of the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.process_username description: The username under which the process is running. type: String - contextPath: CarbonBlackDefense.Process.Results.regmod_count description: The number of registry modifications made by the process. type: Number - contextPath: CarbonBlackDefense.Process.Results.scriptload_count description: The number of scripts loaded by the process. type: Number - name: cbd-find-observation-details-results arguments: - name: polling defaultValue: false hidden: true description: 'When set to false, the function will not use polling and will return the process status or the result if the process is complete.' - name: job_id required: true description: 'The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud.' - name: rows description: The number of rows to request. description: 'Retrieves the search results using the specified job ID.' polling: true outputs: - contextPath: CarbonBlackDefense.EventDetails.Results.alert_category description: The category of the alert associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.alert_id description: The unique ID of the alert associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.backend_timestamp description: The timestamp when the observation data was collected from the backend. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.childproc_count description: The number of child processes spawned by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.crossproc_count description: The number of cross-process interactions involving the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_external_ip description: The external IP address of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_group_id description: The group ID associated with the device. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_id description: The unique ID of the device where the observation was made. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_installed_by description: The user or process that installed the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_internal_ip description: The internal IP address of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_location description: The physical or network location of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_name description: The name of the device where the observation was made. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_os description: The operating system of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_os_version description: The version of the operating system of the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_policy description: The policy applied to the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_policy_id description: The unique ID of the policy applied to the device. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.device_sensor_version description: The version of the sensor installed on the device. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_target_priority description: The priority level of the device as a target. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.device_timestamp description: The timestamp when the observation was recorded on the device. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.document_guid description: The GUID of the document associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.enriched description: Indicates whether the observation data has been enriched with additional information. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.enriched_event_type description: The type of event after enrichment. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.event_threat_score description: The threat score associated with the event. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.filemod_count description: The number of file modifications made by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.ingress_time description: The time when the observation data was ingested into the system. type: Date - contextPath: CarbonBlackDefense.EventDetails.Results.legacy description: Indicates whether the observation is from a legacy system or data source. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.modload_count description: The number of modules loaded by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.netconn_count description: The number of network connections established by the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.observation_description description: A description of the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.observation_id description: The unique observation ID. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.observation_type description: The type of observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.org_id description: The organization ID associated with the observation. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_cmdline description: The command line arguments of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_cmdline_length description: The length of the command line arguments of the parent process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.parent_effective_reputation description: The effective reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_effective_reputation_source description: The source of the effective reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_guid description: The GUID of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_hash description: The hash of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_name description: The name of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.parent_publisher description: The publisher of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_publisher_state description: The state of the publisher of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.parent_reputation description: The reputation of the parent process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_cmdline description: The command line arguments of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_cmdline_length description: The length of the command line arguments of the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.process_company_name description: The company name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_effective_reputation description: The effective reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_effective_reputation_source description: The source of the effective reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_elevated description: Indicates whether the observed process is running with elevated privileges. type: Boolean - contextPath: CarbonBlackDefense.EventDetails.Results.process_file_description description: The description of the observed process file. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_guid description: The GUID of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_hash description: The hash of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_integrity_level description: The integrity level of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_internal_name description: The internal name of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_name description: The name of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_original_filename description: The original filename of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_pid description: The PID of the observed process. type: Number - contextPath: CarbonBlackDefense.EventDetails.Results.process_privileges description: The privileges associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_product_name description: The product name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_product_version description: The product version associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_publisher description: The publisher of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_publisher_state description: The state of the publisher of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_reputation description: The reputation of the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_service_name description: The service name associated with the observed process. type: String - contextPath: CarbonBlackDefense.EventDetails.Results.process_sha256 description: The SHA-256 hash. - name: cbd-find-observation-results arguments: - name: polling defaultValue: false hidden: true description: 'When set to false, the function will not use polling and will return the process status or the result if the process is complete.' - name: job_id required: true description: The unique ID for the process search job. This ID is used to retrieve the results of the process search initiated by Carbon Black Cloud. - name: rows description: The number of rows to request. description: 'Retrieves the search results using the specified job ID.' polling: true outputs: - contextPath: CarbonBlackDefense.Events.Results.alert_category description: 'Category of the alert associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.alert_id description: The unique alert ID. type: String - contextPath: CarbonBlackDefense.Events.Results.backend_timestamp description: 'Timestamp when the event was processed on the backend.' type: Date - contextPath: CarbonBlackDefense.Events.Results.childproc_count description: 'Number of child processes spawned by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.crossproc_count description: 'Number of cross-process operations performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.device_external_ip description: 'External IP address of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_group_id description: The device group ID. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_id description: The unique device ID. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_installed_by description: 'User or entity that installed the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_internal_ip description: 'Internal IP address of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_location description: 'Physical or network location of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_name description: 'Name of the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_os description: 'Operating system running on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_os_version description: 'Version of the operating system running on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_policy description: 'Security policy applied to the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_policy_id description: The ID of the security policy applied to the device. type: Number - contextPath: CarbonBlackDefense.Events.Results.device_sensor_version description: 'Version of the sensor installed on the device.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_target_priority description: 'Priority of the device as a target.' type: String - contextPath: CarbonBlackDefense.Events.Results.device_timestamp description: 'Timestamp of the event as recorded by the device.' type: Date - contextPath: CarbonBlackDefense.Events.Results.document_guid description: The global unique ID for the document associated with the event. type: String - contextPath: CarbonBlackDefense.Events.Results.enriched description: 'Indicates whether the event data has been enriched.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.enriched_event_type description: 'Type of the enriched event.' type: String - contextPath: CarbonBlackDefense.Events.Results.event_threat_score description: 'Threat score assigned to the event.' type: Number - contextPath: CarbonBlackDefense.Events.Results.filemod_count description: 'Number of file modifications performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.ingress_time description: 'Time when the event was ingested by the system.' type: Date - contextPath: CarbonBlackDefense.Events.Results.legacy description: 'Indicates whether the event is considered a legacy event.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.modload_count description: 'Number of modules loaded by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.netconn_count description: 'Number of network connections established by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.observation_description description: 'Description of the observation associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.observation_id description: The unique observation ID. type: String - contextPath: CarbonBlackDefense.Events.Results.observation_type description: 'Type of the observation associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.org_id description: The ID of the organization associated with the event. type: String - contextPath: CarbonBlackDefense.Events.Results.parent_cmdline description: 'Command line used to execute the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_cmdline_length description: 'Length of the command line used to execute the parent process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.parent_effective_reputation description: 'Effective reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_effective_reputation_source description: 'Source of the effective reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_guid description: The global unique ID for the parent process. type: String - contextPath: CarbonBlackDefense.Events.Results.parent_hash description: 'Hash of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_name description: 'Name of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_pid description: The process ID of the parent process. type: Number - contextPath: CarbonBlackDefense.Events.Results.parent_publisher description: 'Publisher of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_publisher_state description: 'Publisher state of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.parent_reputation description: 'Reputation of the parent process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_cmdline description: 'Command line used to execute the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_cmdline_length description: 'Length of the command line used to execute the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.process_company_name description: 'Company name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_effective_reputation description: 'Effective reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_effective_reputation_source description: 'Source of the effective reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_elevated description: 'Indicates whether the process is running with elevated privileges.' type: Boolean - contextPath: CarbonBlackDefense.Events.Results.process_file_description description: 'File description of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_guid description: The global unique process ID. type: String - contextPath: CarbonBlackDefense.Events.Results.process_hash description: 'Hash of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_integrity_level description: 'Integrity level of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_internal_name description: 'Internal name of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_name description: 'Name of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_original_filename description: 'Original filename of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_pid description: The process ID of the process. type: Number - contextPath: CarbonBlackDefense.Events.Results.process_privileges description: 'Privileges associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_product_name description: 'Product name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_product_version description: 'Product version associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_publisher description: 'Publisher of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_publisher_state description: 'Publisher state of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_reputation description: 'Reputation of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_service_name description: 'Service name associated with the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_sha256 description: 'SHA-256 hash of the process.' type: String - contextPath: CarbonBlackDefense.Events.Results.process_start_time description: 'Start time of the process.' type: Date - contextPath: CarbonBlackDefense.Events.Results.process_username description: 'Username under which the process is running.' type: String - contextPath: CarbonBlackDefense.Events.Results.regmod_count description: 'Number of registry modifications performed by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.scriptload_count description: 'Number of scripts loaded by the process.' type: Number - contextPath: CarbonBlackDefense.Events.Results.sensor_action description: 'Action taken by the sensor for the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.ttp description: 'Tactics, techniques, and procedures associated with the event.' type: String - contextPath: CarbonBlackDefense.Events.Results.watchlist_hit description: 'Indicates if the event matches a watchlist entry.' type: String dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - carbonBlackEndpointStandardV3TestPlaybook fromversion: 6.10.0 defaultmapperin: "Carbon Black Endpoint Standard-mapper"