Carbon Black Enterprise EDR

VMware Carbon Black Enterprise EDR (formerly known as Carbon Black ThreatHunter) is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter).

Endpoint · Carbon Black Cloud Enterprise EDR

Configuration parameters

  • url — Server URL (e.g. https://defense.conferdeploy.net) (required)
  • organization_key — Organization Key (required)
  • custom_key — Custom Key
  • custom_id — Custom ID
  • credentials_custom — Custom ID
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • fetch_limit — Fetch limit
  • incidentFetchInterval — Incidents Fetch Interval

Commands (39)

  • cb-eedr-add-alert-notes

    Update alert ID notes.

  • cb-eedr-add-threat-notes

    Update threat ID notes.

  • cb-eedr-add-threat-tags

    Update threat ID tags.

  • cb-eedr-alert-workflow-update

    Updates the workflow of a single alert.

  • cb-eedr-device-background-scan

    Start a background scan on device.

  • cb-eedr-device-background-scan-stop

    Stops a background scan on the specified devices.

  • cb-eedr-device-bypass

    Enable a bypass on device.

  • cb-eedr-device-policy-update

    Update device policy.

  • cb-eedr-device-quarantine

    Quarantines a device.

  • cb-eedr-device-unbypass

    Disable a bypass on device.

  • cb-eedr-device-unquarantine

    Removes a device from quarantine.

  • cb-eedr-devices-list

    List devices based on the search query.

  • cb-eedr-events-by-process-get

    Retrieves the events associated with a given process.

  • cb-eedr-file-device-summary

    Gets an overview of the devices that executed the file.

  • cb-eedr-file-paths

    Return a summary of the observed file paths.

  • cb-eedr-files-download-link-get

    The files are able to be downloaded via AWS S3 pre-signed URLs.

  • cb-eedr-get-file-metadata

    Returns all of the metadata for the specified binary identified by the SHA256 hash.

  • cb-eedr-get-threat-tags

    Output a list of tags for the provided threat ID.

  • cb-eedr-get-watchlist-by-id

    Gets watchlist information by watchlist ID.

  • cb-eedr-ioc-ignore

    IOC ioc_id for report report_id will not match future events for any watchlist.

  • cb-eedr-ioc-ignore-status

    Gets the current ignore status for IOC ioc_id in report report_id.

  • cb-eedr-ioc-reactivate

    IOC ioc_id for report report_id will match future events for all watchlists.

  • cb-eedr-list-alerts

    Returns a list of alerts.

  • cb-eedr-process-search

    Creates a process search job and returns results if 'polling' argument is True.

  • cb-eedr-process-search-results

    Retrieves the process search results for a given job ID.

  • cb-eedr-report-create

    Adds a new watchlist report.

  • cb-eedr-report-get

    Retrieves the specified report.

  • cb-eedr-report-ignore

    Report with report_id and all contained IOCs will not match future events for any watchlist.

  • cb-eedr-report-ignore-status

    Get current ignore status for report with report_id.

  • cb-eedr-report-reactivate

    Report with report_id and all contained IOCs will match future events for all watchlists.

  • cb-eedr-report-remove

    Remove report with report_id.

  • cb-eedr-report-update

    Updates the specified report.

  • cb-eedr-watchlist-alerts-disable

    Turns off alerts for the watchlist with the specified watchlist ID.

  • cb-eedr-watchlist-alerts-enable

    Turns on alerts for the watchlist with the specified watchlist ID.

  • cb-eedr-watchlist-alerts-status

    Retrieves the alert status for the watchlist with given watchlist ID.

  • cb-eedr-watchlist-create

    Creates a new report or classifier watchlist.

  • cb-eedr-watchlist-delete

    Removes the specified watchlist.

  • cb-eedr-watchlist-list

    Retrieves all watchlists.

  • cb-eedr-watchlist-update

    Updates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist.