Carbon Black Enterprise EDR
VMware Carbon Black Enterprise EDR (formerly known as Carbon Black ThreatHunter) is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter).
Endpoint · Carbon Black Cloud Enterprise EDR
Details
| ID | Carbon Black Enterprise EDR |
|---|---|
| Provider | Broadcom |
| Category | Endpoint |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Overview
VMware Carbon Black Enterprise EDR is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter)
Configure VMware Carbon Black Enterprise EDR on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for VMware Carbon Black Enterprise EDR.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g. https://defense.conferdeploy.net)
- Organization Key
- Custom Key
- Custom ID
- Fetch incidents
- Incident type
- Trust any certificate (not secure)
- Use system proxy settings
- First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
- Fetch limit
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- cb-eedr-alert-workflow-update
- cb-eedr-device-quarantine
- cb-eedr-device-unquarantine
- cb-eedr-device-background-scan-stop
- cb-eedr-device-background-scan
- cb-eedr-device-bypass
- cb-eedr-device-unbypass
- cb-eedr-device-policy-update
- cb-eedr-devices-list
- cb-eedr-list-alerts
- cb-eedr-watchlist-list
- cb-eedr-get-watchlist-by-id
- cb-eedr-watchlist-alerts-status
- cb-eedr-watchlist-alerts-enable
- cb-eedr-watchlist-alerts-disable
- cb-eedr-watchlist-create
- cb-eedr-watchlist-delete
- cb-eedr-watchlist-update
- cb-eedr-report-get
- cb-eedr-ioc-ignore-status
- cb-eedr-ioc-ignore
- cb-eedr-ioc-reactivate
- cb-eedr-report-ignore
- cb-eedr-report-reactivate
- cb-eedr-report-ignore-status
- cb-eedr-report-remove
- cb-eedr-report-create
- cb-eedr-report-update
- cb-eedr-file-device-summary
- cb-eedr-get-file-metadata
- cb-eedr-files-download-link-get
- cb-eedr-file-paths
- cb-eedr-process-search
- cb-eedr-events-by-process-get
- cb-eedr-process-search-results
1. cb-eedr-alert-workflow-update
Updates the workflow of a single event.
Required Permissions
RBAC Permissions Required - org.alerts.dismiss: EXECUTE
Base Command
cb-eedr-alert-workflow-update
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | The ID of the alert to update. Get the ID from list_alerts command. | Required |
| status | Workflow status to update. | Optional |
| comment | Comment to include with the operation. | Optional |
| closure_reason | The closure reason | Optional |
| determination | Value judgement of whether the alert(s) represent a true or false positive. | Optional |
| end | The upper bound of the time range. Requires start and must be a timestamp after start. | Optional |
| start | The lower bound of the time range. Requires end and must be a timestamp before end. | Optional |
| time_range | Relative time range for the request. Should not be provided if using ‘start’ and ‘end’ arguments. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Alert.AlertID | String | The alert ID. |
| CarbonBlackEEDR.Alert.ChangedBy | String | User that changed the ID. |
| CarbonBlackEEDR.Alert.Comment | String | Comment that was included with the operation. |
| CarbonBlackEEDR.Alert.LastUpdateTime | Date | Last time the alert was updated. |
| CarbonBlackEEDR.Alert.Remediation | String | Description or justification for the change. |
| CarbonBlackEEDR.Alert.State | String | The alert state. |
Command Example
!cb-eedr-alert-workflow-update alert_id=A28C720DCBCD66333A624893AB1E0FE9 status=open
Context Example
{
"CarbonBlackEEDR.Alert": {
"Comment": null,
"ChangedBy": "ATL5Y9DR4B",
"AlertID": "A28C720DCBCD66333A624893AB1E0FE9",
"LastUpdateTime": "2020-05-26T13:33:12.890Z",
"Status": "OPEN",
"Remediation": null
}
}
Human Readable Output
Successfully updated the alert: “A28C720DCBCD66333A624893AB1E0FE9”
| changed_by | last_update_time | state |
|---|---|---|
| ATL5Y9DR4B | 2020-05-26T13:33:12.890Z | OPEN |
2. cb-eedr-device-quarantine
Quarantines a device.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cb-eedr-device-quarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-quarantine device_id="1225783"
Human Readable Output
The device [‘1225783’] has been quarantined successfully.
3. cb-eedr-device-unquarantine
Removes a device from quarantine.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cb-eedr-device-unquarantine
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-unquarantine device_id="1225783"
Human Readable Output
The device [‘1225783’] has been unquarantined successfully.
4. cb-eedr-device-background-scan-stop
Stops a background scan on the specified devices.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cb-eedr-device-background-scan-stop
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-background-scan-stop device_id="1225783"
Human Readable Output
The device [‘1225783’] background scan has been disabled successfully.
5. cb-eedr-device-background-scan
Start a background scan on device.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cb-eedr-device-background-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-background-scan device_id="1225783"
Human Readable Output
The device [‘1225783’] background scan has been enabled successfully.
6. cb-eedr-device-bypass
Enable a bypass on device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cb-eedr-device-bypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-bypass device_id="1225783"
Human Readable Output
The device [‘1225783’] bypass has been enabled successfully.
7. cb-eedr-device-unbypass
Disable a bypass on device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cb-eedr-device-unbypass
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-unbypass device_id="1225783"
Human Readable Output
The device [‘1225783’] bypass has been disabled successfully.
8. cb-eedr-device-policy-update
Update device policy.
Required Permissions
RBAC Permissions Required - device.policy: EXECUTE
Base Command
cb-eedr-device-policy-update
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
| policy_id | The policy ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-policy-update device_id=1225783 policy_id=12064
Human Readable Output
The policy 12064 has been assigned to device [‘1225783’] successfully.
9. cb-eedr-devices-list
List devices based on the search query.
Required Permissions
RBAC Permissions Required - device: READ
Base Command
cb-eedr-devices-list
Input
| Argument Name | Description | Required |
|---|---|---|
| device_id | The device ID. Supports comma-separated values. | Optional |
| status | The device status. Supports comma-separated values. | Optional |
| device_os | Device operation system. Supports comma-separated values. | Optional |
| start_time | Device start last contact time. For example: 2019-01-01T11:00:00.157Z | Optional |
| end_time | Device end last contact time. For example: 2019-01-01T11:00:00.157Z | Optional |
| ad_group_id | Active directory group ID. Supports comma-separated values | Optional |
| policy_id | The policy ID. Supports comma-separated values. | Optional |
| target_priority | Device target priority. Supports comma-separated values | Optional |
| limit | Maximum number of rows to return | Optional |
| sort_field | Sort Fields | Optional |
| sort_order | Sort Order for field. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Device.sensor_out_of_date | Boolean | Is the device sensor out of date. |
| CarbonBlackEEDR.Device.vdi_base_device | String | vdi base device. |
| CarbonBlackEEDR.Device.linux_kernel_version | String | Linux kernel version. |
| CarbonBlackEEDR.Device.mac_address | String | Device MAC address. |
| CarbonBlackEEDR.Device.os | String | Device operating system. |
| CarbonBlackEEDR.Device.last_device_policy_changed_time | Date | Last device policy changed time. |
| CarbonBlackEEDR.Device.last_reset_time | Date | Last reset time. |
| CarbonBlackEEDR.Device.sensor_states | String | Device sensor state. |
| CarbonBlackEEDR.Device.last_external_ip_address | String | Last external IP address. |
| CarbonBlackEEDR.Device.organization_id | Number | Organization ID. |
| CarbonBlackEEDR.Device.sensor_kit_type | String | Sensor kit type. |
| CarbonBlackEEDR.Device.policy_id | Number | Device policy ID. |
| CarbonBlackEEDR.Device.login_user_name | String | Login user name. |
| CarbonBlackEEDR.Device.deregistered_time | Date | Deregistered time. |
| CarbonBlackEEDR.Device.registered_time | Date | Registered time. |
| CarbonBlackEEDR.Device.name | String | Device name. |
| CarbonBlackEEDR.Device.last_device_policy_requested_time | Date | Last device policy requested time. |
| CarbonBlackEEDR.Device.scan_last_complete_time | Date | Scan last complete time. |
| CarbonBlackEEDR.Device.last_shutdown_time | Date | Last shutdown time. |
| CarbonBlackEEDR.Device.scan_last_action_time | String | Device scan last action time. |
| CarbonBlackEEDR.Device.windows_platform | String | Windows platform. |
| CarbonBlackEEDR.Device.last_reported_time | Date | Device last reported time. |
| CarbonBlackEEDR.Device.device_owner_id | Number | Device owner ID. |
| CarbonBlackEEDR.Device.target_priority | String | Target priority. |
| CarbonBlackEEDR.Device.status | String | Device status. |
| CarbonBlackEEDR.Device.sensor_version | String | Sensor version. |
| CarbonBlackEEDR.Device.virtual_machine | Boolean | Is the device virtual machine |
| CarbonBlackEEDR.Device.last_name | String | Last name. |
| CarbonBlackEEDR.Device.scan_status | String | Scan status. |
| CarbonBlackEEDR.Device.last_internal_ip_address | String | Last internal IP address. |
| CarbonBlackEEDR.Device.last_policy_updated_time | Date | Last policy updated time. |
| CarbonBlackEEDR.Device.last_contact_time | Date | Device last contact time. |
| CarbonBlackEEDR.Device.quarantined | Boolean | Is the device quarantined. |
| CarbonBlackEEDR.Device.virtualization_provider | String | Virtualization Provider. |
| CarbonBlackEEDR.Device.organization_name | String | Organization Name. |
| CarbonBlackEEDR.Device.ad_group_id | String | Active directory group ID. |
| CarbonBlackEEDR.Device.policy_name | String | Policy name. |
| CarbonBlackEEDR.Device.policy_override | Boolean | Policy override. |
| CarbonBlackEEDR.Device.first_name | String | First name. |
| CarbonBlackEEDR.Device.current_sensor_policy_name | String | Current sensor policy name. |
| CarbonBlackEEDR.Device.id | String | Device ID. |
| CarbonBlackEEDR.Device.av_status | String | av status. |
| CarbonBlackEEDR.Device.av_pack_version | String | av pack version. |
| CarbonBlackEEDR.Device.email | String | User email. |
| CarbonBlackEEDR.Device.os_version | String | Device OS version. |
| CarbonBlackEEDR.Device.av_product_version | String | AV product version. |
| CarbonBlackEEDR.Device.last_location | String | Device last location. |
| Endpoint.ID | String | The unique ID within the tool retrieving the endpoint. |
| Endpoint.OS | String | Endpoint OS. |
| Endpoint.OSVersion | String | OS version. |
| Endpoint.MACAddress | String | The MAC address of the endpoint. |
Command Example
##### Context Example
{
“CarbonBlackEEDR.Device”: [
{
“last_reported_time”: “2020-05-26T10:39:01.346Z”,
“last_name”: null,
“last_device_policy_changed_time”: “2020-05-20T11:59:21.298Z”,
“sensor_version”: “3.4.0.820”,
“scan_status”: null,
“policy_name”: “test”,
“sensor_pending_update”: false,
“device_owner_id”: 354312,
“current_sensor_policy_name”: “test”,
“last_device_policy_requested_time”: “2020-05-20T12:03:35.744Z”,
“id”: 2244290,
“sensor_states”: [
“ACTIVE”,
“LIVE_RESPONSE_NOT_RUNNING”,
“LIVE_RESPONSE_NOT_KILLED”,
“LIVE_RESPONSE_ENABLED”,
“SECURITY_CENTER_OPTLN_DISABLED”
],
“deregistered_time”: null,
“last_external_ip_address”: “2.2.2.2”,
“middle_name”: null,
“last_location”: “OFFSITE”,
“sensor_kit_type”: “WINDOWS”,
“target_priority”: “HIGH”,
“organization_name”: “cb-test.com”,
“os_version”: “Windows 10 x64”,
“quarantined”: false,
“mac_address”: “000000000000”,
“av_update_servers”: null,
“virtualization_provider”: “UNKNOWN”,
“registered_time”: “2019-03-28T15:52:36.830Z”,
“uninstall_code”: “ZHZZRBAB”,
“email”: “introspect”,
“sensor_out_of_date”: true,
“av_vdf_version”: “8.16.46.30”,
“status”: “REGISTERED”,
“av_ave_version”: “8.3.60.28”,
“virtual_machine”: false,
“av_last_scan_time”: null,
“ad_group_id”: 0,
“windows_platform”: null,
“av_pack_version”: “8.5.0.58”,
“av_status”: [
“AV_ACTIVE”,
“ONDEMAND_SCAN_DISABLED”
],
“organization_id”: 1190,
“last_reset_time”: null,
“scan_last_action_time”: null,
“last_shutdown_time”: “2020-01-16T01:53:02.733Z”,
“policy_override”: true,
“av_master”: false,
“last_contact_time”: “2020-05-26T13:32:36.272Z”,
“name”: “DESKTOP-QOKND73”,
“activation_code_expiry_time”: “2019-04-04T15:52:36.799Z”,
“scan_last_complete_time”: null,
“last_internal_ip_address”: “8.8.8.8”,
“linux_kernel_version”: null,
“vdi_base_device”: null,
“passive_mode”: false,
“login_user_name”: null,
“av_engine”: “4.9.0.264-ave.8.3.60.28:avpack.2.4.1.58:vdf.8.16.46.30:apc.2.2.2.2”,
“device_meta_data_item_list”: [
{
“key_name”: “OS_MAJOR_VERSION”,
“key_value”: “Windows 10”,
“position”: 0
},
{
“key_name”: “SUBNET”,
“key_value”: “10.67.50”,
“position”: 0
}
],
“last_policy_updated_time”: “2020-02-13T03:56:45.796Z”,
“av_product_version”: “4.9.0.264”,
“first_name”: null,
“activation_code”: null,
“os”: “WINDOWS”,
“policy_id”: 12064
}
]
}
##### Human Readable Output
### Devices list results
|ID|LastContactTime|LastExternalIpAddress|LastInternalIpAddress|LastLocation|Name|OS|PolicyName|Quarantined|TargetPriority|status|
|---|---|---|---|---|---|---|---|---|---|---|
| 1244290 | 2020-05-26T13:32:36.272Z | 2.2.2.2 | 3.3.3.3 | OFFSITE | DESKTOP-ABCND73 | WINDOWS | test | false | HIGH | REGISTERED |
| 127519 | 2020-05-26T13:32:36.257Z | 4.4.4.4 | 10.10.10.10 | OFFSITE | AGENT-PC | WINDOWS | Detection_Servers | false | HIGH | REGISTERED |
| 5425783 | 2020-05-26T13:32:23.788Z | 8.8.8.8 | 10.10.10.10 | OFFSITE | Alphab-Win10-VM-1 | WINDOWS | test | false | HIGH | REGISTERED |
### 10. cb-eedr-list-alerts
---
Returns a list of alerts.
##### Required Permissions
RBAC Permissions Required - org.alerts: READ
##### Base Command
`cb-eedr-list-alerts`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| minimum_severity | Alert minimum severity. | Optional |
| device_os_version | Device OS version. Supports comma-separated values. | Optional |
| policy_id | The policy ID. Supports comma-separated values. | Optional |
| alert_tag | Alert tags. Supports comma-separated values. | Optional |
| alert_id | Alert ID. Supports comma-separated values. | Optional |
| device_username | Device username. Supports comma-separated values. | Optional |
| device_id | Device ID. Supports comma-separated values. | Optional |
| device_os | Device OS. Supports comma-separated values. | Optional |
| process_sha256 | Process SHA256. Supports comma-separated values. | Optional |
| policy_name | Policy name. Supports comma-separated values. | Optional |
| reputation | Alert reputation. Supports comma-separated values. | Optional |
| alert_type | Alert type. Supports comma-separated values. | Optional |
| device_name | Device name. Supports comma-separated values. | Optional |
| process_name | Process name. Supports comma-separated values. | Optional |
| sort_field | Field by which to sort the results. Can be "first_event_time", "last_event_time", "severity", or "target_value". | Optional |
| sort_order | How to order the results. Can be "ASC" (ascending) or "DESC" (descending). The default is "DESC". | Optional |
| limit | The maximum number of results to return. The default is 10. | Optional |
| start_time | Alert start time. | Optional |
| end_time | Alert end time. | Optional |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Alert.threat_id | String | Threat ID. |
| CarbonBlackEEDR.Alert.first_event_time | Date | First event time. |
| CarbonBlackEEDR.Alert.target_value | String | Alert target value. |
| CarbonBlackEEDR.Alert.reason | String | Alert reason. |
| CarbonBlackEEDR.Alert.org_key | String | Organization key. |
| CarbonBlackEEDR.Alert.device_id | String | Device ID. |
| CarbonBlackEEDR.Alert.report_id | String | Report ID. |
| CarbonBlackEEDR.Alert.watchlists.id | String | Watchlist ID. |
| CarbonBlackEEDR.Alert.watchlists.name | String | Watchlist name. |
| CarbonBlackEEDR.Alert.device_os_version | String | Device OS version. |
| CarbonBlackEEDR.Alert.threat_cause_threat_category | String | Threat cause threat category. |
| CarbonBlackEEDR.Alert.policy_id | String | Policy ID. |
| CarbonBlackEEDR.Alert.threat_indicators.process_name | String | Threat indicator - process name. |
| CarbonBlackEEDR.Alert.threat_indicators.sha256 | String | Indicator SHA256 hash. |
| CarbonBlackEEDR.Alert.threat_cause_actor_sha256 | String | Threat cause actor SHA256. |
| CarbonBlackEEDR.Alert.device_os | String | Device OS. |
| CarbonBlackEEDR.Alert.document_guid | String | Document GUID. |
| CarbonBlackEEDR.Alert.create_time | Date | Alert create time. |
| CarbonBlackEEDR.Alert.threat_cause_actor_name | String | Threat cause actor name. |
| CarbonBlackEEDR.Alert.ioc_hit | String | IOC hit. |
| CarbonBlackEEDR.Alert.threat_cause_reputation | String | Threat cause reputation. |
| CarbonBlackEEDR.Alert.legacy_alert_id | String | Legacy alert ID. |
| CarbonBlackEEDR.Alert.device_name | String | Device name. |
| CarbonBlackEEDR.Alert.report_name | String | Report name. |
| CarbonBlackEEDR.Alert.policy_name | String | Policy name. |
| CarbonBlackEEDR.Alert.ioc_field | String | IOC field. |
| CarbonBlackEEDR.Alert.tags | String | Alert tags. |
| CarbonBlackEEDR.Alert.process_guid | String | Process GUID. |
| CarbonBlackEEDR.Alert.threat_cause_actor_md5 | String | Threat cause actor MD5 hash. |
| CarbonBlackEEDR.Alert.last_update_time | Date | Alert last updated time. |
| CarbonBlackEEDR.Alert.type | String | Alert type. |
| CarbonBlackEEDR.Alert.id | String | Alert ID. |
| CarbonBlackEEDR.Alert.process_name | String | Process name. |
| CarbonBlackEEDR.Alert.last_event_time | Date | Alert last event time. |
| CarbonBlackEEDR.Alert.ioc_id | String | IOC ID. |
| CarbonBlackEEDR.Alert.notes_present | Boolean | Whether notes are present. |
| CarbonBlackEEDR.Alert.run_state | String | Alert run state. |
| CarbonBlackEEDR.Alert.severity | Number | Alert severity. |
| CarbonBlackEEDR.Alert.threat_cause_vector | String | Threat cause vector. |
| CarbonBlackEEDR.Alert.device_username | String | Device username. |
| CarbonBlackEEDR.Alert.workflow.changed_by | String | Alert workflow - changed by. |
| CarbonBlackEEDR.Alert.workflow.comment | String | Alert workflow - comment. |
| CarbonBlackEEDR.Alert.workflow.last_update_time | Date | Alert workflow - last updated time. |
| CarbonBlackEEDR.Alert.workflow.remediation | String | Alert workflow - remediation. |
| CarbonBlackEEDR.Alert.workflow.state | String | Alert workflow - state |
##### Command Example
```!cb-eedr-list-alerts```
##### Context Example
{
“CarbonBlackEEDR.Alert”: [
{
“last_update_time”: “2020-05-13T13:31:15.024Z”,
“report_name”: “Report for itype = ‘mal_ip’”,
“last_event_time”: “2020-05-13T13:26:55.640Z”,
“threat_cause_reputation”: “KNOWN_MALWARE”,
“policy_name”: “test-policy”,
“create_time”: “2020-05-13T13:31:15.024Z”,
“id”: “ED0B5E6AE0C0E631FABC7E186CE036A5”,
“threat_indicators”: [
{
“sha256”: “067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e8a”,
“process_name”: “067f1b8f1e0b2bfe123f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.exe”,
“ttps”: [
“e18e60af525e8240a2a4cfef34cc45a4”
]
}
],
“device_name”: “DESKTOP-AB3H40D”,
“device_os”: “WINDOWS”,
“category”: “THREAT”,
“device_username”: “test@atest.com”,
“threat_cause_actor_name”: “123f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.exe”,
“severity”: 10,
“threat_cause_actor_sha256”: “345f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b”,
“workflow”: {
“comment”: null,
“last_update_time”: “2020-05-25T09:38:41.101Z”,
“changed_by”: “ABC5Y9DR4B”,
“remediation”: “just for testing”,
“state”: “DISMISSED”
},
“document_guid”: “MncmKURBNMS1IGM7r6T2ug”,
“ioc_field”: “netconn_ipv4”,
“process_guid”: “7DESJ9NM-00346702-00001cc4-00000000-1d6292928b64305”,
“report_id”: “xSnGrSquRJjsh6A2pM8hsA-TS-Report-7”,
“type”: “WATCHLIST”,
“threat_cause_threat_category”: null,
“threat_cause_vector”: “UNKNOWN”,
“tags”: null,
“process_name”: “067f1b8f1e0b2bfe123f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.exe”,
“reason”: “Process 067f1b8f1e0b2bfe123f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b.exe was detected by the report "Report for itype = ‘mal_ip’" in watchlist "ThreatStream_ITYPE"”,
“threat_cause_actor_md5”: “21a563f123b73d453ad91e251b11855c”,
“ioc_hit”: “2.2.2.2”,
“device_id”: 1234242,
“count”: 0,
“threat_id”: “6C90312382C314B22BEA8D90170FB9A3”,
“target_value”: “MEDIUM”,
“first_event_time”: “2020-05-13T13:26:55.640Z”,
“watchlists”: [
{
“id”: “AB6iVKG3SoqBYvmXxtAmfg”,
“name”: “Test_ITYPE”
}
],
“device_os_version”: null,
“notes_present”: false,
“ioc_id”: “e18e60af525e1234a2a4cfef34cc73a4”,
“legacy_alert_id”: “7ABCJ9GN-00346702-00001cc4-00000000-1d6292928b64305-xSnGrSquRJifv6A2pM8hsA-TS-Report-7”,
“run_state”: “RAN”,
“org_key”: “7DABJ9GN”,
“policy_id”: 36196
}
]
}
##### Human Readable Output
### Alerts list results
|AlertID|CreateTime|DeviceID|DeviceName|DeviceOS|PolicyName|ProcessName|Type|WorkflowState|
|---|---|---|---|---|---|---|---|---|
| ED0C9E6AE0C0E631FABC7E145CE036A5 | 2020-05-13T13:31:15.024Z | 1234242 | DESKTOP-AB3H40D | WINDOWS | test1 | 067f1b8f1e0b2bfe286f5169e17834e8cf7f4123b8d97f28ea78995dc81b0e7b.exe | WATCHLIST | DISMISSED |
| A28C720DCBCD77222A621233AB1E0FE9 | 2020-04-27T12:21:51.294Z | 3450646 | TESTERONAPPS-CBDEF-1 | WINDOWS | test | svchost.exe | WATCHLIST | OPEN |
### 11. cb-eedr-watchlist-list
---
Retrieves all watchlists.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-watchlist-list`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Watchlist.classifier | String | Watchlist classifier. |
| CarbonBlackEEDR.Watchlist.last_update_timestamp | Date | Watchlist last updated timestamp. |
| CarbonBlackEEDR.Watchlist.name | String | Watchlist name. |
| CarbonBlackEEDR.Watchlist.report_ids | String | Watchlist report IDs. |
| CarbonBlackEEDR.Watchlist.create_timestamp | Date | Watchlist created timestamp. |
| CarbonBlackEEDR.Watchlist.id | String | Watchlist ID. |
| CarbonBlackEEDR.Watchlist.tags_enabled | Boolean | Whether tags are enabled for the watchlist. |
| CarbonBlackEEDR.Watchlist.description | String | Watchlist description. |
##### Command Example
```!cb-eedr-watchlist-list```
##### Context Example
{
“CarbonBlackEEDR.Watchlist”: [
{
“description”: “this is a test watchlist”,
“name”: “test watchlist”,
“last_update_timestamp”: 1589380783,
“tags_enabled”: false,
“alerts_enabled”: false,
“create_timestamp”: 1589380783,
“report_ids”: [
“A59huyinQSmAr8t1a2hpg”
],
“id”: “2Bge40iPRCachAa1oYqMkA”,
“classifier”: null
},
{
“description”: “this is a test watchlist”,
“name”: “test watchlist1”,
“last_update_timestamp”: 1589380803,
“tags_enabled”: false,
“alerts_enabled”: false,
“create_timestamp”: 1589380803,
“report_ids”: [
“A59huyinQSmAr8t1a2hpg”
],
“id”: “AiyyP5o1T6ia2LGBIuZtg”,
“classifier”: null
},
{
“description”: “this is a test watchlist”,
“name”: “test watchlist123”,
“last_update_timestamp”: 1589380858,
“tags_enabled”: false,
“alerts_enabled”: false,
“create_timestamp”: 1589380858,
“report_ids”: [
“A59huyinQSmAr8t1a2hpg”
],
“id”: “5xq2xyrKRTOMzt5V8SaJQ”,
“classifier”: null
}
{
“description”: “Updating description”,
“name”: “test1”,
“last_update_timestamp”: 1589456792,
“tags_enabled”: true,
“alerts_enabled”: true,
“create_timestamp”: 1589456617,
“report_ids”: null,
“id”: “n4O82vT2TPa5Tuw54jmVLg”,
“classifier”: {
“value”: “krOSyGQmSVNfxDgIkHSA”,
“key”: “feed_id”
}
}
]
}
##### Human Readable Output
### Carbon Black Enterprise EDR Watchlists
|ID|Name|Description|create_timestamp|Alerts_enabled|Tags_enabled|Report_ids|Last_update_timestamp|Classifier|
|---|---|---|---|---|---|---|---|---|
| AjQoLZwJRYu4oPC22YpepQ | test watchlist2 | | 2020-05-26T13:27:44.000Z | true | true | A59huyinQSmAr8t1a2hpg | 2020-05-26T13:27:44.000Z | |
| 2Bge40iPRCachAa1oYqMkA | test watchlist | this is a test watchlist | 2020-05-13T14:39:43.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:39:43.000Z | |
| AiyyP5o1T6ia2LGBIuZtg | test watchlist1 | this is a test watchlist | 2020-05-13T14:40:03.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:40:03.000Z | |
| 5xq2xyrKRTOMzt5V8SaJQ | test watchlist123 | this is a test watchlist | 2020-05-13T14:40:58.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:40:58.000Z | |
| MXzJPzWYRuuKBEsy0UXImA | Cigent Watchlist | | 2020-01-16T21:07:58.000Z | true | true | MLRtPcpQGKFh5OE4BT3tQ-19d3af31-5dbd-4b9f-9b1d-e8ddca6af991 | 2020-01-28T18:19:14.000Z | |
### 12. cb-eedr-get-watchlist-by-id
---
Gets watchlist information by watchlist ID.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-get-watchlist-by-id`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Watchlist.classifier | String | Watchlist classifier. |
| CarbonBlackEEDR.Watchlist.last_update_timestamp | Date | Watchlist last updated timestamp. |
| CarbonBlackEEDR.Watchlist.name | String | Watchlist name. |
| CarbonBlackEEDR.Watchlist.report_ids | String | Watchlist report IDs. |
| CarbonBlackEEDR.Watchlist.create_timestamp | Date | Watchlist created timestamp. |
| CarbonBlackEEDR.Watchlist.id | String | Watchlist ID. |
| CarbonBlackEEDR.Watchlist.tags_enabled | Boolean | Whether tags are enabled for the watchlist. |
| CarbonBlackEEDR.Watchlist.description | String | Watchlist description. |
| CarbonBlackEEDR.Watchlist.Aaerts_enabled | Boolean | Whether alerts are enabled for the watchlists. |
##### Command Example
```!cb-eedr-get-watchlist-by-id watchlist_id="JI5wCDVTPGEgbWlDCoGgQ"```
##### Context Example
{
“CarbonBlackEEDR.Watchlist”: {
“description”: “test description”,
“name”: “test watchlist1”,
“last_update_timestamp”: 1589379124,
“tags_enabled”: false,
“alerts_enabled”: true,
“create_timestamp”: 1568314084,
“report_ids”: [
“A59huyinQSmAr8t1a2hpg”
],
“id”: “JI5wCDVTPGEgbWlDCoGgQ”,
“classifier”: null
}
}
##### Human Readable Output
### Watchlist JI5wCDVTPGEgbWlDCoGgQ information
|ID|Name|Description|create_timestamp|Alerts_enabled|Tags_enabled|Report_ids|Last_update_timestamp|
|---|---|---|---|---|---|---|---|
| JI5wCDVTPGEgbWlDCoGgQ | test watchlist1 | test description | 1970-01-19T03:38:34.000Z | true | false | A59huyinQSmAr8t1a2hpg | 1970-01-19T09:29:39.000Z |
### 13. cb-eedr-watchlist-alerts-status
---
Retrieves the alert status for the watchlist with given watchlist ID.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-watchlist-alerts-status`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-watchlist-alerts-status watchlist_id=AiyyP5o1T6ia2LGBIuZtg```
##### Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert status is On
### 14. cb-eedr-watchlist-alerts-enable
---
Turns on alerts for the watchlist with the specified watchlist ID.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-watchlist-alerts-enable`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-watchlist-alerts-enable watchlist_id=AiyyP5o1T6ia2LABIuZtg```
##### Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert was enabled successfully.
### 15. cb-eedr-watchlist-alerts-disable
---
Turns off alerts for the watchlist with the specified watchlist ID.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-watchlist-alerts-disable`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-watchlist-alerts-disable watchlist_id=AiyyP5o1T6ia2LABIuZtg```
##### Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert was disabled successfully.
### 16. cb-eedr-watchlist-create
---
Creates a new report or classifier watchlist.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: CREATE
##### Base Command
`cb-eedr-watchlist-create`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_name | The name of the watchlist. | Required |
| description | The watchlist description. | Optional |
| tags_enabled | Whether to enable watchlist tags. Can be "true" or "false". | Optional |
| alerts_enabled | Enable watchlist alerts | Optional |
| report_ids | The report IDs for creating the watchlist. Supports comma-separated values. | Optional |
| classifier_key | The classifier key for creating the watchlist. | Optional |
| classifier_value | The classifier value for creating the watchlist. | Optional |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Watchlist.Classifier | String | The watchlist classifier. |
| CarbonBlackEEDR.Watchlist.Last_update_timestamp | Date | Watchlist last updated timestamp. |
| CarbonBlackEEDR.Watchlist.Name | String | Watchlist name. |
| CarbonBlackEEDR.Watchlist.Report_ids | String | Watchlist report ID. |
| CarbonBlackEEDR.Watchlist.Create_timestamp | Date | Watchlist created timestamp. |
| CarbonBlackEEDR.Watchlist.Alerts_enabled | Boolean | Whether alerts are enabled in the watchlist. |
| CarbonBlackEEDR.Watchlist.ID | String | Watchlist ID. |
| CarbonBlackEEDR.Watchlist.Tags_enabled | Boolean | Whether tags are enabled in the watchlist. |
| CarbonBlackEEDR.Watchlist.Description | String | Watchlist description. |
##### Command Example
```!cb-eedr-watchlist-create watchlist_name="test watchlist3" alerts_enabled=false tags_enabled=false report_ids=A59huyinQSmAr8t1a2hpg```
##### Context Example
{
“CarbonBlackEEDR.Watchlist”: {
“Description”: null,
“Tags_enabled”: true,
“Alerts_enabled”: true,
“Classifier”: null,
“Create_timestamp”: “2020-05-26T13:33:19.000Z”,
“Report_ids”: [
“A59huyinQSmAr8t1a2hpg”
],
“ID”: “Bz4PlP5RSiGLvekCLbC0A”,
“Name”: “test watchlist3”
}
}
##### Human Readable Output
### The watchlist "test watchlist3" created successfully
|Name|ID|Create_timestamp|Tags_enabled|Alerts_enabled|Report_ids|
|---|---|---|---|---|---|
| test watchlist3 | Bz4PlP5RSiGLvekCLbC0A | 2020-05-26T13:33:19.000Z | true | true | A59huyinQSmAr8t1a2hpg |
### 17. cb-eedr-watchlist-delete
---
Removes the specified watchlist.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
##### Base Command
`cb-eedr-watchlist-delete`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID to remove. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-watchlist-delete watchlist_id=AjQoLZwJRYu4oPC22YpepQ```
##### Human Readable Output
The watchlist AjQoLZwJRYu4oPC22YpepQ was deleted successfully.
### 18. cb-eedr-watchlist-update
---
Updates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
##### Base Command
`cb-eedr-watchlist-update`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| watchlist_id | The watchlist ID to update. | Required |
| watchlist_name | The watchlist name. | Optional |
| description | Watchlist description. | Optional |
| tags_enabled | Whether to enable watchlist tags. Can be "true" or "false". | Optional |
| alerts_enabled | Enable watchlist alerts. | Optional |
| report_ids | Watchlist report ID. Supports comma-separated values. | Optional |
| classifier_key | The classifier key to update. | Optional |
| classifier_value | The classifier value to update. | Optional |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Watchlist.Classifier | String | The watchlist classifier. |
| CarbonBlackEEDR.Watchlist.Last_update_timestamp | Date | Watchlist last update timestamp. |
| CarbonBlackEEDR.Watchlist.Name | String | Watchlist name. |
| CarbonBlackEEDR.Watchlist.Report_ids | String | Watchlist report ID. |
| CarbonBlackEEDR.Watchlist.Create_timestamp | Date | Watchlist created timestamp. |
| CarbonBlackEEDR.Watchlist.Alerts_enabled | Boolean | Whether alerts are enabled in the watchlist. |
| CarbonBlackEEDR.Watchlist.ID | String | Watchlist ID. |
| CarbonBlackEEDR.Watchlist.Tags_enabled | Boolean | Whether tags are enabled in the watchlist. |
| CarbonBlackEEDR.Watchlist.Description | String | Watchlist description. |
##### Command Example
```!cb-eedr-watchlist-update watchlist_id=2Bge40iPRCachAa1oYqMkA alerts_enabled=true watchlist_name="new name"```
##### Context Example
{
“CarbonBlackEEDR.Watchlist”: {
“Description”: null,
“Tags_enabled”: false,
“Alerts_enabled”: true,
“Classifier”: null,
“Create_timestamp”: “2020-05-13T14:39:43.000Z”,
“Report_ids”: [],
“ID”: “2Bge40iPRCachAa1oYqMkA”,
“Name”: “new name”
}
}
##### Human Readable Output
### The watchlist "2Bge40iPRCachAa1oYqMkA" was updated successfully
|Name|ID|Create_timestamp|Tags_enabled|Alerts_enabled|
|---|---|---|---|---|
| new name | 2Bge40iPRCachAa1oYqMkA | 2020-05-13T14:39:43.000Z | false | true |
### 19. cb-eedr-report-get
---
Retrieves the specified report.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-report-get`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
| CarbonBlackEEDR.Report.Title | String | Report title. |
| CarbonBlackEEDR.Report.Tags | String | Report tags. |
| CarbonBlackEEDR.Report.Link | String | Report link. |
| CarbonBlackEEDR.Report.ID | String | Report ID. |
| CarbonBlackEEDR.Report.Timestamp | Date | Report timestamp. |
| CarbonBlackEEDR.Report.Description | String | Report description. |
| CarbonBlackEEDR.Report.Severity | Number | Report severity. |
| CarbonBlackEEDR.Report.IOCs | String | The report's IOCs. |
##### Command Example
```!cb-eedr-report-get report_id="A59huyinQSmAr8t1a2hpg"```
##### Context Example
{
“CarbonBlackEEDR.Report”: {
“Severity”: 8,
“Tags”: [
“SAMPLE”
],
“Timestamp”: “1970-01-19T06:40:07.000Z”,
“IOCs”: [
{
“values”: [
“(process_name:chrome.exe)”
],
“field”: null,
“match_type”: “query”,
“link”: null,
“id”: “860ececb-2a2e-4dc5-bdbd-f6f45657cf7c”
},
{
“values”: [
“(process_name:chrome.exe)”
],
“field”: null,
“match_type”: “query”,
“link”: null,
“id”: “f551ba63-0c7a-48ec-b12d-c4b2a9f4b922”
},
{
“values”: [
“(netconn_ipv4:2.2.2.2)”
],
“field”: null,
“match_type”: “query”,
“link”: null,
“id”: “c86187e3-90e3-4fb0-a698-18112b294059”
},
{
“values”: [
“(process_name:c\:\\users\\administrator\\desktop\\badfile.exe)”
],
“field”: null,
“match_type”: “query”,
“link”: null,
“id”: “46e11795-e7ee-4f8e-8ad8-44b1d2216e30”
}
],
“Title”: “badfile.exe”,
“Visibility”: null,
“Link”: null,
“ID”: “A59huyinQSmAr8t1a2hpg”,
“Description”: “”
}
}
##### Human Readable Output
### Report "A59huyinQSmAr8t1a2hpg" information
|ID|Title|Timestamp|Severity|Tags|
|---|---|---|---|---|
| A59huyinQSmAr8t1a2hpg | badfile.exe.exe | 1970-01-19T06:40:07.000Z | 8 | SAMPLE |
### The IOCs for the report
|ID|Match_type|Values|
|---|---|---|
| 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c | query | (process_name:chrome.exe) |
| f551ba63-0c7a-48ec-b12d-c4b2a9f4b922 | query | (process_name:chrome.exe) |
| c86187e3-90e3-4fb0-a698-18112b294059 | query | (netconn_ipv4:2.2.2.2) |
| 46e11795-e7ee-4f8e-8ad8-44b1d2216e30 | query | (process_name:c\:\\users\\administrator\\desktop\\badfile.exe) |
### 20. cb-eedr-ioc-ignore-status
---
Gets the current ignore status for IOC ioc_id in report report_id.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-ioc-ignore-status`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | Report ID. Get the ID from the watchlist-list command. | Required |
| ioc_id | IOC ID. Get the ID from get_report command | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-ioc-ignore-status ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c status is false
### 21. cb-eedr-ioc-ignore
---
IOC ioc_id for report report_id will not match future events for any watchlist.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
##### Base Command
`cb-eedr-ioc-ignore`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | Report ID. Get the ID from the watchlist-list command. | Required |
| ioc_id | IOC ID. Get the ID from get_report command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-ioc-ignore ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
The IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c for report A59huyinQSmAr8t1a2hpg will not match future events for any watchlist.
### 22. cb-eedr-ioc-reactivate
---
IOC ioc_id for report report_id will match future events for all watchlists.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
##### Base Command
`cb-eedr-ioc-reactivate`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | Report ID. Get the ID from the watchlist-list command. | Required |
| ioc_id | IOC ID. Get the ID from get_report command | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-ioc-reactivate ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c for report A59huyinQSmAr8t1a2hpg will match future events for all watchlists.
### 23. cb-eedr-report-ignore
---
Report with report_id and all contained IOCs will not match future events for any watchlist.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
##### Base Command
`cb-eedr-report-ignore`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-report-ignore report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
The report with report_id "A59huyinQSmAr8t1a2hpg" and all contained IOCs will not match future events for any watchlist.
### 24. cb-eedr-report-reactivate
---
Report with report_id and all contained IOCs will match future events for all watchlists.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
##### Base Command
`cb-eedr-report-reactivate`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-report-reactivate report_id=qtcpqJwuRjaFZWjAT8zhqQ```
##### Human Readable Output
Report with report_id "qtcpqJwuRjaFZWjAT8zhqQ" and all contained IOCs will match future events for all watchlists
### 25. cb-eedr-report-ignore-status
---
Get current ignore status for report with report_id.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
##### Base Command
`cb-eedr-report-ignore-status`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-report-ignore-status report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
ignore status for report with report_id "A59huyinQSmAr8t1a2hpg" is enabled.
### 26. cb-eedr-report-remove
---
Remove report with report_id.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
##### Base Command
`cb-eedr-report-remove`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID to remove. Get the ID from the watchlist-list command. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
```!cb-eedr-report-remove report_id=A59huyinQSmAr8t1a2hpg```
##### Human Readable Output
The report "A59huyinQSmAr8t1a2hpg" was deleted successfully.
### 27. cb-eedr-report-create
---
Adds a new watchlist report.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: CREATE
##### Base Command
`cb-eedr-report-create`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| title | The report title. | Required |
| description | The report description. | Required |
| tags | The report tags. Supports comma-separated values. | Optional |
| severity | The report severity (In range of 1-10). | Required |
| ipv4 | IOCs of type IPv4. Supports comma-separated values. | Optional |
| ioc_query | The IOC query for the report, for example: (netconn_ipv4:2.2.2.2). Supports comma-separated values. | Optional |
| timestamp | The report timestamp. For example: 2020-01-19T09:16:16 | Required |
| ipv6 | IOCs of type IPv6. Supports comma-separated values. | Optional |
| md5 | IOCs of type MD5. Supports comma-separated values. | Optional |
| dns | IOCs of type DNS. Supports comma-separated values. | Optional |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Report.ID | String | The report ID. |
| CarbonBlackEEDR.Report.IOCs | String | The report IOCs |
| CarbonBlackEEDR.Report.Link | String | Report link. |
| CarbonBlackEEDR.Report.Severity | Number | Report severity. |
| CarbonBlackEEDR.Report.Timestamp | Date | The report timestamp. |
| CarbonBlackEEDR.Report.Title | String | The report title. |
| CarbonBlackEEDR.Report.Tags | String | Report tags. |
| CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
| CarbonBlackEEDR.Report.Description | String | The report description. |
##### Command Example
```!cb-eedr-report-create title="Report test" description="Testing new report creation" tags="one,two,three" severity="5" ipv4="2.2.2.2,3.3.3.3" timestamp="2019-01-01T00:00:16"```
##### Context Example
{
“CarbonBlackEEDR.Report”: {
“Severity”: 5,
“Tags”: [
“one”,
“two”,
“three”
],
“Timestamp”: “1970-01-18T21:31:40.000Z”,
“IOCs”: [
{
“values”: [
“2.2.2.2”,
“3.3.3.3”
],
“field”: “netconn_ipv4”,
“match_type”: “equality”,
“link”: null,
“id”: “56e85f3d538b0602b10e0b544c3f61ea”
}
],
“Title”: “Report test”,
“Visibility”: null,
“Link”: null,
“ID”: “rbwEBRfnTUGB6LqTUcgWg”,
“Description”: “Testing new report creation”
}
}
##### Human Readable Output
### The report was created successfully
|ID|Title|Timestamp|Description|Severity|Tags|
|---|---|---|---|---|---|
| rbwEBRfnTUGB6LqTUcgWg | Report test | 1970-01-18T21:31:40.000Z | Testing new report creation | 5 | one,two,three |
### The IOCs for the report
|Field|ID|Match_type|Values|
|---|---|---|---|
| netconn_ipv4 | 56e85f3d538b0602b10e0b544c3f61ea | equality | 2.2.2.2,3.3.3.3 |
### 28. cb-eedr-report-update
---
Updates the specified report.
##### Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
##### Base Command
`cb-eedr-report-update`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| report_id | The report ID to update. | Required |
| title | The report title. | Required |
| description | The report description. | Required |
| tags | The report tags. Supports comma-separated values. | Optional |
| ipv4 | IOC of type IPv4. Supports comma-separated values. | Optional |
| ipv6 | IOC of type IPv6. Supports comma-separated values. | Optional |
| dns | IOC of type DNS. Supports comma-separated values. | Optional |
| md5 | IOC of type MD5. Supports comma-separated values. | Optional |
| ioc_query | Query IOC. For example: (netconn_ipv4:2.2.2.2). Supports comma-separated values. | Optional |
| severity | Report severity (In range of 1-10). | Required |
| timestamp | The report timestamp. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.Report.ID | String | The report ID. |
| CarbonBlackEEDR.Report.IOCs | String | The report IOC's |
| CarbonBlackEEDR.Report.Link | String | Report link. |
| CarbonBlackEEDR.Report.Severity | Number | Report severity. |
| CarbonBlackEEDR.Report.Timestamp | Date | The report timestamp. |
| CarbonBlackEEDR.Report.Title | String | The report title. |
| CarbonBlackEEDR.Report.Tags | String | Report tags. |
| CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
| CarbonBlackEEDR.Report.Description | String | The report description. |
##### Command Example
```!cb-eedr-report-update description="new description" report_id=qtcpqJwuRjaFZWjAT8zhqQ severity=5 timestamp=2020-05-19T09:18:48 title="new title"```
##### Context Example
{
“CarbonBlackEEDR.Report”: {
“Severity”: 5,
“Tags”: null,
“Timestamp”: “2473-10-23T21:08:00.000Z”,
“IOCs”: [],
“Title”: “new title”,
“Visibility”: null,
“Link”: null,
“ID”: “qtcpqJwuRjaFZWjAT8zhqQ”,
“Description”: “new description”
}
}
##### Human Readable Output
### The report was updated successfully
|ID|Title|Timestamp|Description|Severity|
|---|---|---|---|---|
| qtcpqJwuRjaFZWjAT8zhqQ | new title | 2473-10-23T21:08:00.000Z | new description | 5 |
### The IOCs for the report
__No entries.__
### 29. cb-eedr-file-device-summary
---
Gets an overview of the devices that executed the file.
##### Required Permissions
RBAC Permissions Required - Ubs.org.sha256
##### Base Command
`cb-eedr-file-device-summary`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| sha256 | The requested SHA256 hash to obtain information for. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.File.first_seen_device_id | Number | The device ID of the device that first saw this file. |
| CarbonBlackEEDR.File.first_seen_device_name | String | The name of the device that first saw this file. |
| CarbonBlackEEDR.File.first_seen_device_timestamp | Date | The time that this file was first seen, for this organization. |
| CarbonBlackEEDR.File.last_seen_device_id | Number | The device ID of the device that most recently saw this file. |
| CarbonBlackEEDR.File.last_seen_device_name | String | The name of the device that last saw this file. |
| CarbonBlackEEDR.File.last_seen_device_timestamp | Date | The time that this file was most recently seen for this organization. |
| CarbonBlackEEDR.File.num_devices | Number | The total number of devices, for this organization, that have observed this file. |
| CarbonBlackEEDR.File.sha256 | String | The SHA256 hash of the file. |
##### Command Example
```!cb-eedr-file-device-summary sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa"```
##### Context Example
{
“CarbonBlackEEDR.File”: {
“last_seen_device_timestamp”: “2020-05-21T06:59:07.866395Z”,
“num_devices”: 3,
“last_seen_device_id”: 1246865,
“first_seen_device_timestamp”: “2020-05-18T09:26:28.205254Z”,
“sha256”: “4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa”,
“last_seen_device_name”: “testcorewin764”,
“first_seen_device_name”: “test732-PC”,
“first_seen_device_id”: 1294302
}
}
##### Human Readable Output
### The file device summary
|first_seen_device_id|first_seen_device_name|first_seen_device_timestamp|last_seen_device_id|last_seen_device_name|last_seen_device_timestamp|num_devices|sha256|
|---|---|---|---|---|---|---|---|
| 1294302 | test732-PC | 2020-05-18T09:26:28.205254Z | 1246865 | testcorewin764 | 2020-05-21T06:59:07.866395Z | 3 | 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa |
### 30. cb-eedr-get-file-metadata
---
Returns all of the metadata for the specified binary identified by the SHA256 hash.
##### Required Permissions
RBAC Permissions Required - Ubs.org.sha256
##### Base Command
`cb-eedr-get-file-metadata`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| sha256 | The requested SHA256 hash to obtain metadata information. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.File.file_size | Number | The size of the actual file. This is the size of the file represented by this hash. |
| CarbonBlackEEDR.File.file_available | Boolean | If true, the file is available for download. |
| CarbonBlackEEDR.File.sha256 | String | The SHA256 hash of the file. |
| CarbonBlackEEDR.File.product_version | String | Product version from FileVersionInformation. |
| CarbonBlackEEDR.File.product_description | String | Product description from FileVersionInformation. |
| CarbonBlackEEDR.File.lang_id | String | The Language ID value from the Windows VERSIONINFO resource. |
| CarbonBlackEEDR.File.company_name | String | Company name from FileVersionInformation |
| CarbonBlackEEDR.File.internal_name | String | Internal name from FileVersionInformation. |
| CarbonBlackEEDR.File.charset_id | Number | The Character set ID value from the Windows VERSIONINFO resource. |
| CarbonBlackEEDR.File.available_file_size | Number | The size of the file, that is available for download. If the file is unavailable the size will be zero. |
| CarbonBlackEEDR.File.architecture | String | The set of architectures that this file was compiled for. This may contain one or more of the following values: none, x86, amd64, and arm64. |
| CarbonBlackEEDR.File.comments | String | Comments from FileVersionInformation. |
| CarbonBlackEEDR.File.os_type | String | The OS that this file is designed for. This may contain one or more of the following values: WINDOWS, ANDROID, MAC, IOS, LINUX, and OTHER |
| CarbonBlackEEDR.File.original_filename | String | Original filename from FileVersionInformation. |
| CarbonBlackEEDR.File.file_version | String | File version from FileVersionInformation. |
| CarbonBlackEEDR.File.file_description | String | File description from FileVersionInformation. |
| CarbonBlackEEDR.File.product_name | String | Product name from FileVersionInformation. |
| CarbonBlackEEDR.File.md5 | String | The MD5 hash of the file. |
##### Command Example
```!cb-eedr-get-file-metadata sha256=4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa```
##### Context Example
{
“CarbonBlackEEDR.File”: {
“product_version”: “16.1.0.0”,
“original_filename”: “AutoPico.exe”,
“charset_id”: 1200,
“file_available”: true,
“file_version”: “16.1.0.0”,
“product_description”: null,
“comments”: “Portable”,
“sha256”: “4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa”,
“available_file_size”: 745664,
“lang_id”: null,
“company_name”: “testCompany”,
“internal_name”: test.exe”,
“file_size”: 745664,
“os_type”: “WINDOWS”,
“md5”: “cfe1c123464c446099a5eb33276f6d57”,
“product_name”: “Product”,
“file_description”: “Product”,
“architecture”: [
“x86”
]
}
}
##### Human Readable Output
### The file metadata
|SHA256|comments|file_size|internal_name|original_filename|os_type|
|---|---|---|---|---|---|
| 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa | Portable | 745664 | test.exe | test.exe | WINDOWS |
### 31. cb-eedr-files-download-link-get
---
The files are able to be downloaded via AWS S3 pre-signed URLs.
##### Required Permissions
RBAC Permissions Required - Ubs.org.file
##### Base Command
`cb-eedr-files-download-link-get`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| sha256 | An array of SHA256 hashes (limit 100). Supports comma-separated values. | Required |
| expiration_seconds | The number of seconds to make the download URLs available for. The default is 300. | Optional |
| download_to_xsoar | Download the file to XSOAR. | Optional |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.File.found.sha256 | String | SHA256 hash of file that is available to be downloaded |
| CarbonBlackEEDR.File.found.url | String | An AWS S3 pre-signed URL for this file. Perform a GET on this URL to download the file. |
| CarbonBlackEEDR.File.not_found | String | The SHA256 hashes that were not found. |
| CarbonBlackEEDR.File.error | String | The SHA256 hashes that had an intermittent error. |
##### Command Example
```!cb-eedr-files-download-link-get sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa" expiration_seconds="3600" download_to_xsoar="false"```
##### Context Example
{
“CarbonBlackEEDR.File”: {
“found”: [
{
“url”: “https://cdc-file-storage-production-us-east-1.s3.amazonaws.com/4a/71/4d/98/ce/40/f5/f3/57/7c/30/6a/66/cb/4a/6b/1f/f3/fd/01/04/7c/7f/45/81/f8/55/8f/0b/cd/f5/fa/4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAVT6ZCSICASU327FI%2F20200526%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20200526T133305Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjAAwaCXVzLWVhc3QtMSJIMEYCIQCqqdEFtwaybOvJkycEEMnMQLR%2FoNSvmNbsb%2Bchb5UEpAIhAPZTjLn4T8p3IGfkKQ0CpEEot%2FLR9oI17UIKtAV1Ej7fKr0DCKT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQAhoMMzg2NDY1NDM2MTY0IgyYvqWtKKorgx1b%2FXYqkQMeEOokBfnVZv0RtN1W3G3sW97NreAGknB7LRsG1QVMc4b4vrRmgvPvY1ZuE8hAIOu40RQfWBEgfiQo9URFcVRqzKFi8zrLEKlX0NinYijdgA8nHKFIlqSuPRArHXhwixq4aUzQ%2B3uh9UxM%2FrwSYItYn3skiacUz6TwqLFzjfWk3YIFMH3bP4jD9q7omZHgtA6PM%2BCbsf%2Fzj2DwI8JXGKyOm0jAMpNr8wz7n1gLoFnB5WHe4ELHpBfnAh%2Fe5r1H62n0y4eT%2B19zNuNZFd7jjr1FYgounceibjgvlGILMN3xhQWpjzUgssL3GprTM%2FCFy3FzxfPnjUcgJJ%2BjAJw9AICH2yCkFiY6IglFzQwzK%2BC5Q7HvEYmStt682IvQg6ZdYoWuH7iPf7ypiMB%2Bd4o2LwnJ67xCVitD0oLxFMYgIub4buB0dlSwy%2FskcERt81xlhWIZhxRYEDxyTtMPwYSRu5El7vvui5W9y0AmLBANjAb4EaFcaOqUIFOlF6JO%2Blt4Jc6LyMzFu3zdOd9Nx7%2Fi6AewgDDN97P2BTrqAdX%2BqmMi8oItlqJdoU9ntWJ2SBR6y2xa%2BCj3GpHLzvrvWMYAQPfcOxXqDYv9UPPAsPPh1Hxl1P0Jua%2BBwmwOA4m9Lak%2BkwqL8oQMUMb68pyRNxv8dTFa1turFetE9%2Bh4NTzHfxH5WhXH58oGt5ozzPmeJmuJrMAJJV%2BMZhdL1eClkK%2FzLKfSboJIgqmvMSXncccSmEc3Ref6qGWXN3k3%2F5YLf4831zEGH%2FUKCnQqU%2F45QVHvPOfuw2%2BIsItIYimn8YRW73TMOpp3frhKVYMiEwhVBNFQESjNLzDfBZgIMKeWjUbHmJT4Cwb82w%3D%3D&X-Amz-Signature=0757be785f81856477277969af21d8076289d4bb92274c42c73b8d2776443763”,
“sha256”: “4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa”
}
],
“not_found”: [],
“error”: []
}
}
##### Human Readable Output
### The file to download
|sha256|url|
|---|---|
| 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa | https://cdc-file-storage-production-us-east-1.s3.amazonaws.com/4a/71/4d/98/ce/40/f5/f3/57/7c/30/6a/66/cb/4a/6b/1f/f3/fd/01/04/7c/7f/45/81/f8/55/8f/0b/cd/f5/fa/4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAVT6ZCSICASU327FI%2F20200526%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20200526T133305Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjAAwaCXVzLWVhc3QtMSJIMEYCIQCqqdEFtwaybOvJkycEEMnMQLR%2FoNSvmNbsb%2Bchb5UEpAIhAPZTjLn4T8p3IGfkKQ0CpEEot%2FLR9oI17UIKtAV1Ej7fKr0DCKT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQAhoMMzg2NDY1NDM2MTY0IgyYvqWtKKorgx1b%2FXYqkQMeEOokBfnVZv0RtN1W3G3sW97NreAGknB7LRsG1QVMc4b4vrRmgvPvY1ZuE8hAIOu40RQfWBEgfiQo9URFcVRqzKFi8zrLEKlX0NinYijdgA8nHKFIlqSuPRArHXhwixq4aUzQ%2B3uh9UxM%2FrwSYItYn3skiacUz6TwqLFzjfWk3YIFMH3bP4jD9q7omZHgtA6PM%2BCbsf%2Fzj2DwI8JXGKyOm0jAMpNr8wz7n1gLoFnB5WHe4ELHpBfnAh%2Fe5r1H62n0y4eT%2B19zNuNZFd7jjr1FYgounceibjgvlGILMN3xhQWpjzUgssL3GprTM%2FCFy3FzxfPnjUcgJJ%2BjAJw9AICH2yCkFiY6IglFzQwzK%2BC5Q7HvEYmStt682IvQg6ZdYoWuH7iPf7ypiMB%2Bd4o2LwnJ67xCVitD0oLxFMYgIub4buB0dlSwy%2FskcERt81xlhWIZhxRYEDxyTtMPwYSRu5El7vvui5W9y0AmLBANjAb4EaFcaOqUIFOlF6JO%2Blt4Jc6LyMzFu3zdOd9Nx7%2Fi6AewgDDN97P2BTrqAdX%2BqmMi8oItlqJdoU9ntWJ2SBR6y2xa%2BCj3GpHLzvrvWMYAQPfcOxXqDYv9UPPAsPPh1Hxl1P0Jua%2BBwmwOA4m9Lak%2BkwqL8oQMUMb68pyRNxv8dTFa1turFetE9%2Bh4NTzHfxH5WhXH58oGt5ozzPmeJmuJrMAJJV%2BMZhdL1eClkK%2FzLKfSboJIgqmvMSXncccSmEc3Ref6qGWXN3k3%2F5YLf4831zEGH%2FUKCnQqU%2F45QVHvPOfuw2%2BIsItIYimn8YRW73TMOpp3frhKVYMiEwhVBNFQESjNLzDfBZgIMKeWjUbHmJT4Cwb82w%3D%3D&X-Amz-Signature=0757be785f81856477277969af21d8076289d4bb92274c42c73b8d2776443763 |
### 32. cb-eedr-file-paths
---
Return a summary of the observed file paths
##### Required Permissions
RBAC Permissions Required - RBAC Permissions Required: READ
##### Base Command
`cb-eedr-file-paths`
##### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| sha256 | The requested SHA256 hash to obtain information for. Supports comma-separated values. | Required |
##### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.File.file_path_count | Number | The total number of unique file paths that have been observed, by this organization, for this file. |
| CarbonBlackEEDR.File.file_paths | String | The file path details. |
| CarbonBlackEEDR.File.sha256 | Unknown | The SHA256 hash of the file. |
| CarbonBlackEEDR.File.total_file_path_count | Number | The total number of file paths that have been observed, by this organization, for this file. |
##### Command Example
```!cb-eedr-file-paths sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa"```
##### Context Example
{
“CarbonBlackEEDR.File”: {
“sha256”: “4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa”,
“file_paths”: [
{
“count”: 3,
“file_path”: “c:\program files\admin\test.exe”,
“first_seen_timestamp”: “2020-05-18T09:26:28.205254Z”
}
],
“total_file_path_count”: 3,
“file_path_count”: 1
}
}
##### Human Readable Output
### The file path for the sha256
|file_path_count|file_paths|sha256|total_file_path_count|
|---|---|---|---|
| 1 | {'count': 3, 'file_path': 'c:\\program files\\admin\\test.exe', 'first_seen_timestamp': '2020-05-18T09:26:28.205254Z'} | 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa | 3 |
### 33. cb-eedr-process-search
---
Creates a process search job and returns results if 'polling' argument is True.
##### Required Permissions
RBAC Permissions Required - org.search.events: CREATE
#### Base Command
`cb-eedr-process-search`
#### Input
| __Argument Name__ | __Description__ | __Required__ |
| --- | --- | --- |
| process_name | The process name to search. | Optional |
| process_hash | The process hash to search. | Optional |
| event_id | The event ID to search. | Optional |
| limit | The maximum number of rows to return. Default is 20. | Optional |
| query | A free-style query. For example, "process_name:svchost.exe". | Optional |
| start_time | First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. | Optional |
| end_time | Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. | Optional |
| start | Index of first records to fetch. Default is 0. | Optional |
#### Context Output
| __Path__ | __Type__ | __Description__ |
| --- | --- | --- |
| CarbonBlackEEDR.SearchProcess.job_id | String | The ID of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.status | String | The status of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.results.device_id | Number | The device ID that is guaranteed to be unique within each PSC environment. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | The user names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.backend_timestamp | Date | A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. |
| CarbonBlackEEDR.SearchProcess.results.childproc_count | Number | The cumulative count of child-process creations since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.crossproc_count | Number | The cumulative count of cross-process events since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.device_group_id | Number | The ID of the sensor group where the device belongs. |
| CarbonBlackEEDR.SearchProcess.results.device_name | String | The name of the device. |
| CarbonBlackEEDR.SearchProcess.results.device_policy_id | Number | The ID of the policy applied to the device. |
| CarbonBlackEEDR.SearchProcess.results.device_timestamp | Date | The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. |
| CarbonBlackEEDR.SearchProcess.results.enriched | Boolean | True if the process document came from the CBD data stream. |
| CarbonBlackEEDR.SearchProcess.results.enriched_event_type | String | The CBD enriched event type. |
| CarbonBlackEEDR.SearchProcess.results.event_type | String | The CBD event type \(valid only for events coming through analytics\). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL. |
| CarbonBlackEEDR.SearchProcess.results.filemod_count | Number | The cumulative count of file modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.ingress_time | Date | Unknown |
| CarbonBlackEEDR.SearchProcess.results.legacy | Boolean | True if the process document came from the legacy data stream \(deprecated, use enriched\). |
| CarbonBlackEEDR.SearchProcess.results.modload_count | Number | The cumulative count of module loads since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.netconn_count | Number | The cumulative count of network connections since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.org_id | String | The globally unique organization key. This will most likely be the PSC organization ID \+ PSC environment ID or some other unique token used across environments. |
| CarbonBlackEEDR.SearchProcess.results.parent_guid | String | The process GUID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.process_guid | String | Unique ID of the Solr document. Appears as process_guid \+ server-side timestamp in epoch ms \(1/1/1970 based\). |
| CarbonBlackEEDR.SearchProcess.results.process_hash | String | The MD5 and SHA256 hashes of the process’s main module in a multi-valued field. |
| CarbonBlackEEDR.SearchProcess.results.process_name | String | The tokenized file path of the process’s main module. |
| CarbonBlackEEDR.SearchProcess.results.process_pid | Number | The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | User names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.regmod_count | Number | The cumulative count of registry modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.scriptload_count | Number | The cumulative count of loaded scripts since process tracking started. |
#### Command Example
```!cb-eedr-process-search process_name="vmtoolsd.exe" limit=10```
#### Context Example
```json
{
"CarbonBlackEEDR": {
"SearchProcess": {
"job_id": "633b7900-2b28-456d-add3-28e665525753",
"status": "In Progress"
}
}
}
Human Readable Output
job_id is 633b7900-2b28-456d-add3-28e665525753.
34. cb-eedr-events-by-process-get
Retrieves the events associated with a given process.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cb-eedr-events-by-process-get
Input
| Argument Name | Description | Required |
|---|---|---|
| process_guid | The process GUID to search. Must be focused on a single process. | Optional |
| event_type | The event type to search. | Optional |
| limit | The maximum number of rows to return. Default is 20. | Optional |
| query | A free-style query. For example, “process_name:svchost.exe”. | Optional |
| start_time | First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. | Optional |
| end_time | Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. | Optional |
| start | Index of first records to fetch. Default is 0. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.SearchEvent.backend_timestamp | Date | The timestamp of when the process was ingested by the backend. |
| CarbonBlackEEDR.SearchEvent.created_timestamp | Date | The timestamp of when the event document was created. |
| CarbonBlackEEDR.SearchEvent.event_guid | String | A globally unique identifier for this event document. |
| CarbonBlackEEDR.SearchEvent.event_hash | String | |
| CarbonBlackEEDR.SearchEvent.event_timestamp | Date | The timestamp of the event on the device. |
| CarbonBlackEEDR.SearchEvent.event_type | String | The event type. Possible values are: filemod, netconn, regmod, modload, crossproc, and childproc. |
| CarbonBlackEEDR.SearchEvent.legacy | Boolean | True if this event comes from the CBD data stream. |
| CarbonBlackEEDR.SearchEvent.modload_action | String | Action associated with the modload operation. The only possible value is: ACTION_LOAD_MODULE. |
| CarbonBlackEEDR.SearchEvent.modload_effective_reputation | String | |
| CarbonBlackEEDR.SearchEvent.modload_md5 | String | The MD5 hash for the modules loaded. |
| CarbonBlackEEDR.SearchEvent.modload_name | String | The modules loaded by this event. |
| CarbonBlackEEDR.SearchEvent.modload_publisher | String | The publisher that signed this module, if any. |
| CarbonBlackEEDR.SearchEvent.modload_publisher_state | String | The set of states associated with the publisher of the module. Can be a combination of: FILE_SIGNATURE_STATE_INVALID, FILE_SIGNATURE_STATE_SIGNED, FILE_SIGNATURE_STATE_VERIFIED, FILE_SIGNATURE_STATE_NOT_SIGNED, FILE_SIGNATURE_STATE_UNKNOWN, FILE_SIGNATURE_STATE_CHAINED, FILE_SIGNATURE_STATE_TRUSTED, FILE_SIGNATURE_STATE_OS, and FILE_SIGNATURE_STATE_CATALOG_SIGNED. |
| CarbonBlackEEDR.SearchEvent.modload_sha256 | String | The SHA256 hash for the modules loaded. |
| CarbonBlackEEDR.SearchEvent.process_guid | String | The process GUID representing the process that this event belongs to. |
| CarbonBlackEEDR.SearchEvent.process_pid | Number | The PID of the process. |
Command Example
!cb-eedr-events-by-process-get process_guid="7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43" event_type="modload" start_time="1 month"
Context Example
{
"CarbonBlackEEDR": {
"SearchEvent": [
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.503Z",
"event_guid": "OCaEtLR1SRGcWgVUcoj2mA",
"event_hash": "lQJi__dhQpGzdVwCmbdbjg",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_LOCAL_WHITE",
"modload_md5": "aae1f614bfe5e3e5cde18d1f928f5b12",
"modload_name": "c:\\windows\\system32\\ctiuser.dll",
"modload_publisher": "Carbon Black, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "81eb5f6fbf8d7566560f43f75ec30e5f0284cdee9b5c9df0d81281bda0db3d07",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "aAVFrvjPQ3Sea-kK6Kdbxw",
"event_hash": "L8CCeipjQ7KtMQDiRwx8HA",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "2c7c14627cff3384c52e61d4dbd0ecc3",
"modload_name": "c:\\windows\\system32\\version.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "41b4d85d84a86e41b948694b9b5f398a0d79f47629d6d969eb5b461d4f5d0347",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "AlKrjPvcSLav4Vq7zBuD2A",
"event_hash": "k7Z5u-3_Siydt1DPvXW4dQ",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "f7c09099232987cbb965b9280c1dacf8",
"modload_name": "c:\\program files\\vmware\\vmware tools\\gmodule-2.0.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "d14560487312f487f94bfaed4fe9d0cfd5efbec1ac4ef44c26dd230800bc6b29",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "0g6iOKO9S8GHIfFSOG5sBA",
"event_hash": "TX8Ehlc2Qb2mbSl8ZtVmgg",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "26fc0a369a68d2a429e2ebe67b8dd1d8",
"modload_name": "c:\\program files\\vmware\\vmware tools\\gobject-2.0.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "9a914642e7e8e4e4ba004004b490c64453f13597cc43cb77a9e55d180c229f83",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "W_JoluvFTni9mPPHCvyxmg",
"event_hash": "CvjnmQdWQqGhbsmkcPzJYA",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "9d9b1790cc6eeb76757b5042914b7289",
"modload_name": "c:\\program files\\vmware\\vmware tools\\intl.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "03eef80ad1d4b066c4842546ba52ccb911e84606a27f0ec7016d9f62c572846b",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "-XTVyKT5SkeJ0PvsnozF6A",
"event_hash": "114rbukXQKSzjhiVBEApPQ",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "a83fcd02a532a08386a5bcbb39a581c5",
"modload_name": "c:\\program files\\vmware\\vmware tools\\glib-2.0.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "ff9bb3a84c807f8151d4956f895f672fa812765e931e9093f40caab0853bd120",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "junO0BiIT9imVAUSKCdB_A",
"event_hash": "9Sd5fEA8R9aOU7eYlY_97A",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "9f2b3fac3440db16e0c13473b551d12c",
"modload_name": "c:\\windows\\system32\\vcruntime140.dll",
"modload_publisher": "Microsoft Corporation",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "27c51ff3dc2f4cf2b61bdf55fb60148ef0abb06c2feae188c30f1a63f9e29caa",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "PocoJ9OATG6Qr-3cirRciQ",
"event_hash": "D8k62OqkQ9KiT0c5C1Ki0g",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "965eb822d0ef8fda78ccb1f41def093d",
"modload_name": "c:\\windows\\system32\\winmm.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "ad43d686930eae0f57a55ee75d10bd1882747089a291371ffe1e131eb5f76938",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "ThWF8yD5R5usoFJM4x_VRw",
"event_hash": "mk9Lj4O0TAq-enCNCKWBMA",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "e6450257ba3df5161684e4c73ebb8f92",
"modload_name": "c:\\windows\\system32\\winmmbase.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "948f13fe144cd80f93565ded2ac2e96d000869bb2761538996d28942495cb1d7",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "PZXgTx_XStWA1DGUkPDJzw",
"event_hash": "UVssy5LWSvyvFC0Isya8aQ",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "821236519995fdfb54b56bd9d7a60ba8",
"modload_name": "c:\\program files\\vmware\\vmware tools\\pcre.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "64388ee3beb0e69fd471b3c7eb5d4de8ae24b9ea0fdba51bc9c81c26be84e585",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "bmsH73bASGaRFpeo84Q5Kw",
"event_hash": "9Ri-_u68QjyV7UjSMeDAYw",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "40b92f37c0698cdc4cde8c0a75791c7e",
"modload_name": "c:\\program files\\vmware\\vmware tools\\vmtools.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "bb8098f4627441f6a29c31757c45339c74b2712b92783173df9ab58d47ae3bfa",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "WeL1uj4FSI-n4rVA7UoXFw",
"event_hash": "b2SKdGkNSNuw0eoZn9wK_g",
"event_timestamp": "2020-10-14T16:17:45.448Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "e202dd92848c5103c9abf8ecd22bc539",
"modload_name": "c:\\windows\\system32\\fltlib.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "353f8d4e647a11f235f4262d913f7bac4c4f266eac4601ea416e861afd611912",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "Q6PB6SqURW6xliJdsEogag",
"event_hash": "YPhofHOyQkKaMGEr1dX5cQ",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "b7be84c53e81dd0a64ee0845410bd6c7",
"modload_name": "c:\\windows\\system32\\icmp.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_CATALOG_SIGNED",
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "8ddd1ddce37c7e560570774de7ca1a1ecf7b32dfd0ba014f504fc6ae50388de6",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "jg_1LLAYT1KZx9SZUPQqeQ",
"event_hash": "5eb6xzwkTt2p5b-2-ELzog",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "3929147a2a34b0902152c7d0f241b02a",
"modload_name": "c:\\windows\\system32\\iphlpapi.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "ad1c5309aa873f6a284eabe382812868e20c3d3d64197f3e6ef9d015ea060caa",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "LDC8YHy4RFuIZuejh202dQ",
"event_hash": "zMI8yTZvRBWnBzcuyUU0bQ",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "da9647c845792371dd2f95e1ccc9a63a",
"modload_name": "c:\\windows\\system32\\sspicli.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "fe741d2f986b0b9557a90bdf0560f49cd17381d1094c42a91634aabe49f46a1e",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "Oq1ZHJ-lSYGWynDM12vIhQ",
"event_hash": "HwnoQEtpSp-El_7fEmh4Lw",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "435009d1ddc0365bfa34b8c8d3f85286",
"modload_name": "c:\\windows\\system32\\ntmarta.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "2f94628f056fe65ea81351e134e59ece813fec5e8400c12d6dfa49defd126d01",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "UpxEQukRRmiX3EjI4kkYYg",
"event_hash": "afxpRq5BT6WRdQyBWS4-kQ",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "3c9d22cae173ad19806b6a016cd4cc28",
"modload_name": "c:\\windows\\system32\\uxtheme.dll",
"modload_publisher": "Microsoft Windows",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_CATALOG_SIGNED",
"FILE_SIGNATURE_STATE_OS",
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "d95e7d07ea46d7d2aefa01cd0a64cf266be26d40fa6be42f7cf60f6deb8fbaf3",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "NcXdQS34QJWySTn-04pakA",
"event_hash": "4ZyNSN7yRyeNNBRop-HMDw",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "1f1fe19bc54c75e568646327f6d99c1a",
"modload_name": "c:\\windows\\system32\\vsocklib.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "e685439d50aecf656ef5bd2523568b6d9220cc9917e7d57eda962c1a520e94a5",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "POYLqKCERASiTMBHcfsFmw",
"event_hash": "UAoluLSYSKe2pzn47rxVDw",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "b56c118a906a0322b9319d50df188bc6",
"modload_name": "c:\\program files\\vmware\\vmware tools\\plugins\\common\\hgfsserver.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "0d74d8f4cf24bc72042234fb92b42396f6d2f6f77c534f9a07af3d82822a0452",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
},
{
"backend_timestamp": "2020-10-14T16:22:13.180Z",
"created_timestamp": "2020-11-04T06:58:51.505Z",
"event_guid": "x2Beg9ykSIiRKViJJxcsaA",
"event_hash": "6xUCWyDQTAuOm7Lnxq-qew",
"event_timestamp": "2020-10-14T16:17:45.463Z",
"event_type": "modload",
"legacy": false,
"modload_action": "ACTION_LOADED_MODULE_DISCOVERED",
"modload_effective_reputation": "REP_WHITE",
"modload_md5": "a381226b5a088a07680391b94c474baa",
"modload_name": "c:\\program files\\vmware\\vmware tools\\hgfs.dll",
"modload_publisher": "VMware, Inc.",
"modload_publisher_state": [
"FILE_SIGNATURE_STATE_SIGNED",
"FILE_SIGNATURE_STATE_TRUSTED",
"FILE_SIGNATURE_STATE_VERIFIED"
],
"modload_sha256": "429a69aba0196be3f53ffa1d2dd09b0caea6fc680468706b2a20fa0f7188ad4b",
"process_guid": "7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43",
"process_pid": 8056
}
]
}
}
Human Readable Output
Results Found
|backend_timestamp|created_timestamp|event_guid|event_hash|event_timestamp|event_type|legacy|modload_action|modload_effective_reputation|modload_md5|modload_name|modload_publisher|modload_publisher_state|modload_sha256|process_guid|process_pid|
|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.503Z | OCaEtLR1SRGcWgVUcoj2mA | lQJi__dhQpGzdVwCmbdbjg | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_LOCAL_WHITE | aae1f614bfe5e3e5cde18d1f928f5b12 | c:\windows\system32\ctiuser.dll | Carbon Black, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 81eb5f6fbf8d7566560f43f75ec30e5f0284cdee9b5c9df0d81281bda0db3d07 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | aAVFrvjPQ3Sea-kK6Kdbxw | L8CCeipjQ7KtMQDiRwx8HA | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 2c7c14627cff3384c52e61d4dbd0ecc3 | c:\windows\system32\version.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 41b4d85d84a86e41b948694b9b5f398a0d79f47629d6d969eb5b461d4f5d0347 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | AlKrjPvcSLav4Vq7zBuD2A | k7Z5u-3_Siydt1DPvXW4dQ | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | f7c09099232987cbb965b9280c1dacf8 | c:\program files\vmware\vmware tools\gmodule-2.0.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | d14560487312f487f94bfaed4fe9d0cfd5efbec1ac4ef44c26dd230800bc6b29 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | 0g6iOKO9S8GHIfFSOG5sBA | TX8Ehlc2Qb2mbSl8ZtVmgg | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 26fc0a369a68d2a429e2ebe67b8dd1d8 | c:\program files\vmware\vmware tools\gobject-2.0.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 9a914642e7e8e4e4ba004004b490c64453f13597cc43cb77a9e55d180c229f83 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | W_JoluvFTni9mPPHCvyxmg | CvjnmQdWQqGhbsmkcPzJYA | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 9d9b1790cc6eeb76757b5042914b7289 | c:\program files\vmware\vmware tools\intl.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 03eef80ad1d4b066c4842546ba52ccb911e84606a27f0ec7016d9f62c572846b | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | -XTVyKT5SkeJ0PvsnozF6A | 114rbukXQKSzjhiVBEApPQ | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | a83fcd02a532a08386a5bcbb39a581c5 | c:\program files\vmware\vmware tools\glib-2.0.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | ff9bb3a84c807f8151d4956f895f672fa812765e931e9093f40caab0853bd120 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | junO0BiIT9imVAUSKCdB_A | 9Sd5fEA8R9aOU7eYlY_97A | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 9f2b3fac3440db16e0c13473b551d12c | c:\windows\system32\vcruntime140.dll | Microsoft Corporation | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 27c51ff3dc2f4cf2b61bdf55fb60148ef0abb06c2feae188c30f1a63f9e29caa | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | PocoJ9OATG6Qr-3cirRciQ | D8k62OqkQ9KiT0c5C1Ki0g | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 965eb822d0ef8fda78ccb1f41def093d | c:\windows\system32\winmm.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | ad43d686930eae0f57a55ee75d10bd1882747089a291371ffe1e131eb5f76938 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | ThWF8yD5R5usoFJM4x_VRw | mk9Lj4O0TAq-enCNCKWBMA | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | e6450257ba3df5161684e4c73ebb8f92 | c:\windows\system32\winmmbase.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 948f13fe144cd80f93565ded2ac2e96d000869bb2761538996d28942495cb1d7 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | PZXgTx_XStWA1DGUkPDJzw | UVssy5LWSvyvFC0Isya8aQ | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 821236519995fdfb54b56bd9d7a60ba8 | c:\program files\vmware\vmware tools\pcre.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 64388ee3beb0e69fd471b3c7eb5d4de8ae24b9ea0fdba51bc9c81c26be84e585 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | bmsH73bASGaRFpeo84Q5Kw | 9Ri-_u68QjyV7UjSMeDAYw | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 40b92f37c0698cdc4cde8c0a75791c7e | c:\program files\vmware\vmware tools\vmtools.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | bb8098f4627441f6a29c31757c45339c74b2712b92783173df9ab58d47ae3bfa | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | WeL1uj4FSI-n4rVA7UoXFw | b2SKdGkNSNuw0eoZn9wK_g | 2020-10-14T16:17:45.448Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | e202dd92848c5103c9abf8ecd22bc539 | c:\windows\system32\fltlib.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 353f8d4e647a11f235f4262d913f7bac4c4f266eac4601ea416e861afd611912 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | Q6PB6SqURW6xliJdsEogag | YPhofHOyQkKaMGEr1dX5cQ | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | b7be84c53e81dd0a64ee0845410bd6c7 | c:\windows\system32\icmp.dll | Microsoft Windows | FILE_SIGNATURE_STATE_CATALOG_SIGNED,
FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 8ddd1ddce37c7e560570774de7ca1a1ecf7b32dfd0ba014f504fc6ae50388de6 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | jg_1LLAYT1KZx9SZUPQqeQ | 5eb6xzwkTt2p5b-2-ELzog | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 3929147a2a34b0902152c7d0f241b02a | c:\windows\system32\iphlpapi.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | ad1c5309aa873f6a284eabe382812868e20c3d3d64197f3e6ef9d015ea060caa | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | LDC8YHy4RFuIZuejh202dQ | zMI8yTZvRBWnBzcuyUU0bQ | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | da9647c845792371dd2f95e1ccc9a63a | c:\windows\system32\sspicli.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | fe741d2f986b0b9557a90bdf0560f49cd17381d1094c42a91634aabe49f46a1e | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | Oq1ZHJ-lSYGWynDM12vIhQ | HwnoQEtpSp-El_7fEmh4Lw | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 435009d1ddc0365bfa34b8c8d3f85286 | c:\windows\system32\ntmarta.dll | Microsoft Windows | FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 2f94628f056fe65ea81351e134e59ece813fec5e8400c12d6dfa49defd126d01 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | UpxEQukRRmiX3EjI4kkYYg | afxpRq5BT6WRdQyBWS4-kQ | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 3c9d22cae173ad19806b6a016cd4cc28 | c:\windows\system32\uxtheme.dll | Microsoft Windows | FILE_SIGNATURE_STATE_CATALOG_SIGNED,
FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | d95e7d07ea46d7d2aefa01cd0a64cf266be26d40fa6be42f7cf60f6deb8fbaf3 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | NcXdQS34QJWySTn-04pakA | 4ZyNSN7yRyeNNBRop-HMDw | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | 1f1fe19bc54c75e568646327f6d99c1a | c:\windows\system32\vsocklib.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | e685439d50aecf656ef5bd2523568b6d9220cc9917e7d57eda962c1a520e94a5 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | POYLqKCERASiTMBHcfsFmw | UAoluLSYSKe2pzn47rxVDw | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | b56c118a906a0322b9319d50df188bc6 | c:\program files\vmware\vmware tools\plugins\common\hgfsserver.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 0d74d8f4cf24bc72042234fb92b42396f6d2f6f77c534f9a07af3d82822a0452 | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
| 2020-10-14T16:22:13.180Z | 2020-11-04T06:58:51.505Z | x2Beg9ykSIiRKViJJxcsaA | 6xUCWyDQTAuOm7Lnxq-qew | 2020-10-14T16:17:45.463Z | modload | false | ACTION_LOADED_MODULE_DISCOVERED | REP_WHITE | a381226b5a088a07680391b94c474baa | c:\program files\vmware\vmware tools\hgfs.dll | VMware, Inc. | FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED | 429a69aba0196be3f53ffa1d2dd09b0caea6fc680468706b2a20fa0f7188ad4b | 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 | 8056 |
Total of 2120 items found. Showing items 0 - 19.
35. cb-eedr-process-search-results
Retrieves the process search results for a given job ID.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cb-eedr-process-search-results
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID to search. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.SearchProcess.job_id | String | The ID of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.status | String | The status of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.results.device_id | Number | The device ID that is guaranteed to be unique within each PSC environment. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | The user names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.backend_timestamp | Date | A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. |
| CarbonBlackEEDR.SearchProcess.results.childproc_count | Number | The cumulative count of child-process creations since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.crossproc_count | Number | The cumulative count of cross-process events since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.device_group_id | Number | The ID of the sensor group where the device belongs. |
| CarbonBlackEEDR.SearchProcess.results.device_name | String | The name of the device. |
| CarbonBlackEEDR.SearchProcess.results.device_policy_id | Number | The ID of the policy applied to the device. |
| CarbonBlackEEDR.SearchProcess.results.device_timestamp | Date | The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. |
| CarbonBlackEEDR.SearchProcess.results.enriched | Boolean | True if the process document came from the CBD data stream. |
| CarbonBlackEEDR.SearchProcess.results.enriched_event_type | String | The CBD enriched event type. |
| CarbonBlackEEDR.SearchProcess.results.event_type | String | The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL. |
| CarbonBlackEEDR.SearchProcess.results.filemod_count | Number | The cumulative count of file modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.ingress_time | Date | Unknown |
| CarbonBlackEEDR.SearchProcess.results.legacy | Boolean | True if the process document came from the legacy data stream (deprecated, use enriched). |
| CarbonBlackEEDR.SearchProcess.results.modload_count | Number | The cumulative count of module loads since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.netconn_count | Number | The cumulative count of network connections since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.org_id | String | The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments. |
| CarbonBlackEEDR.SearchProcess.results.parent_guid | String | The process GUID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.process_guid | String | Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based). |
| CarbonBlackEEDR.SearchProcess.results.process_hash | String | The MD5 and SHA-256 hashes of the process’s main module in a multi-valued field. |
| CarbonBlackEEDR.SearchProcess.results.process_name | String | The tokenized file path of the process’s main module. |
| CarbonBlackEEDR.SearchProcess.results.process_pid | Number | The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | User names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.regmod_count | Number | The cumulative count of registry modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.scriptload_count | Number | The cumulative count of loaded scripts since process tracking started. |
Command Example
!cb-eedr-process-search-results job_id="99aad740-3903-4148-a5e7-7b5648794862"
Context Example
{
"CarbonBlackEEDR": {
"SearchProcess": {
"job_id": "99aad740-3903-4148-a5e7-7b5648794862",
"results": [
{
"backend_timestamp": "2020-10-28T07:20:55.988Z",
"device_group_id": 0,
"device_id": 3775337,
"device_name": "cbcloud-win10",
"device_policy_id": 12229,
"device_timestamp": "2020-10-28T07:20:07.603Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1603869624380,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00399b69-0000028c-00000000-1d6a6bb3b2bcc26",
"parent_pid": 652,
"process_guid": "7DESJ9GN-00399b69-00000b60-00000000-1d6a6bb41ebd8ef",
"process_hash": [
"1169495860abe1bc6a498d2c196787c3",
"fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2912
]
},
{
"backend_timestamp": "2020-10-27T14:47:52.717Z",
"device_group_id": 0,
"device_id": 3739267,
"device_name": "hw-host-027",
"device_policy_id": 12229,
"device_timestamp": "2020-10-27T14:47:13.760Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1603810047142,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00390e83-000002a0-00000000-1d6a1f9ef3c0d3e",
"parent_pid": 672,
"process_guid": "7DESJ9GN-00390e83-00000bf4-00000000-1d6a1f9f37d1836",
"process_hash": [
"1169495860abe1bc6a498d2c196787c3",
"fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
3060
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"backend_timestamp": "2020-10-24T00:58:50.495Z",
"device_group_id": 0,
"device_id": 3739232,
"device_name": "hw-host-004",
"device_policy_id": 12229,
"device_timestamp": "2020-10-24T00:57:37.097Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1603501093672,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00390e60-000002a4-00000000-1d6a463297ebe9b",
"parent_pid": 676,
"process_guid": "7DESJ9GN-00390e60-00000c74-00000000-1d6a4632cda86e3",
"process_hash": [
"1169495860abe1bc6a498d2c196787c3",
"fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
3188
]
},
{
"backend_timestamp": "2020-10-17T14:13:34.936Z",
"device_group_id": 0,
"device_id": 3462642,
"device_name": "win10etchangeme",
"device_policy_id": 6525,
"device_timestamp": "2020-10-17T14:12:28.438Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1602943969760,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-0034d5f2-0000032c-00000000-1d6a276fc5ed489",
"parent_pid": 812,
"process_guid": "7DESJ9GN-0034d5f2-00000b8c-00000000-1d6a27706e318a2",
"process_hash": [
"63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6",
"c7084336325dc8eadfb1e8ff876921c4"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2956
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"backend_timestamp": "2020-10-16T00:36:49.055Z",
"device_group_id": 0,
"device_id": 3216323,
"device_name": "exapil\\pil-cb7-2",
"device_policy_id": 6525,
"device_timestamp": "2020-10-16T00:35:55.328Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1602808577528,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003113c3-00000204-00000000-1d68d438b085325",
"parent_pid": 516,
"process_guid": "7DESJ9GN-003113c3-00000628-00000000-1d68d438ca1bfd4",
"process_hash": [
"63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6",
"c7084336325dc8eadfb1e8ff876921c4"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
1576
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"backend_timestamp": "2020-10-05T02:17:33.365Z",
"device_group_id": 0,
"device_id": 3365471,
"device_name": "hw-host-004",
"device_policy_id": 6525,
"device_timestamp": "2020-10-05T02:16:18.531Z",
"enriched": true,
"enriched_event_type": [
"INJECT_CODE"
],
"event_type": [
"crossproc"
],
"ingress_time": 1601864215004,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00335a5f-00000288-00000000-1d687d4d1d5aec5",
"parent_pid": 648,
"process_guid": "7DESJ9GN-00335a5f-00000abc-00000000-1d687d4d6c9363a",
"process_hash": [
"1169495860abe1bc6a498d2c196787c3",
"fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2748
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"null/AIUNTEPE"
],
"backend_timestamp": "2020-09-03T11:00:49.482Z",
"device_group_id": 791,
"device_id": 3670727,
"device_name": "desktop-fvb88fs",
"device_policy_id": 6525,
"device_timestamp": "2020-09-03T10:59:48.345Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_type": [
"childproc"
],
"ingress_time": 1599130817870,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-003802c7-000002b8-00000000-1d66fbac06780a2",
"parent_pid": 696,
"process_guid": "7DESJ9GN-003802c7-00000b4c-00000000-1d66fbac0f8ad57",
"process_hash": [
"aca121d48147ff717bcd1da7871a5a76",
"da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19ad"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2892
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"null/UQJ5NT2N"
],
"backend_timestamp": "2020-09-03T08:01:52.493Z",
"device_group_id": 791,
"device_id": 3670528,
"device_name": "desktop-fvb88fs",
"device_policy_id": 6525,
"device_timestamp": "2020-09-03T08:00:46.548Z",
"enriched": true,
"enriched_event_type": [
"CREATE_PROCESS"
],
"event_type": [
"childproc"
],
"ingress_time": 1599120076739,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00380200-000002b8-00000000-1d66fbac06780a2",
"parent_pid": 696,
"process_guid": "7DESJ9GN-00380200-00000b4c-00000000-1d66fbac0f8ad57",
"process_hash": [
"aca121d48147ff717bcd1da7871a5a76",
"da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19ad"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2892
],
"process_username": [
"NT AUTHORITY\\SYSTEM"
]
},
{
"alert_category": [
"THREAT"
],
"alert_id": [
"JMLXDNLG/XPU6S91H"
],
"backend_timestamp": "2020-08-26T16:08:11.872Z",
"device_group_id": 0,
"device_id": 3644148,
"device_name": "desktop-aa2m6ld",
"device_policy_id": 6529,
"device_timestamp": "2020-08-26T16:06:50.813Z",
"enriched": true,
"enriched_event_type": [
"FILE_CREATE"
],
"event_type": [
"filemod"
],
"ingress_time": 1598458053780,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-00379af4-00001520-00000000-1d67a883dbd713b",
"parent_pid": 5408,
"process_guid": "7DESJ9GN-00379af4-000007e0-00000000-1d67a8847cebcbd",
"process_hash": [
"80abd555c1869baaff2d8a8d535ce07e",
"fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
2016
],
"process_username": [
"DESKTOP-AA2M6LD\\John Doe"
]
},
{
"backend_timestamp": "2020-08-17T14:38:21.589Z",
"blocked_hash": [
"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53"
],
"device_group_id": 0,
"device_id": 3600261,
"device_name": "desktop-aa2m6ld",
"device_policy_id": 35704,
"device_timestamp": "2020-08-17T14:37:19.963Z",
"enriched": true,
"enriched_event_type": [
"POLICY_ACTION"
],
"event_type": [
"childproc"
],
"ingress_time": 1597675083480,
"legacy": true,
"org_id": "7DESJ9GN",
"parent_guid": "7DESJ9GN-0036ef85-000007f0-00000000-1d674a3d9a6a335",
"parent_pid": 2032,
"process_guid": "7DESJ9GN-0036ef85-00001f74-00000000-1d674a3e4b3ba9a",
"process_hash": [
"80abd555c1869baaff2d8a8d535ce07e",
"fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504"
],
"process_name": "c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe",
"process_pid": [
8052
],
"process_username": [
"DESKTOP-AA2M6LD\\John Doe"
],
"sensor_action": [
"DENY",
"BLOCK"
]
}
],
"status": "Completed"
}
}
}
Human Readable Output
Completed Search Results
process_hash process_name device_name device_timestamp process_pid process_username 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe cbcloud-win10 2020-10-28T07:20:07.603Z 2912 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-027 2020-10-27T14:47:13.760Z 3060 NT AUTHORITY\SYSTEM 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-004 2020-10-24T00:57:37.097Z 3188 63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6,
c7084336325dc8eadfb1e8ff876921c4c:\program files\vmware\vmware tools\vmtoolsd.exe win10etchangeme 2020-10-17T14:12:28.438Z 2956 NT AUTHORITY\SYSTEM 63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6,
c7084336325dc8eadfb1e8ff876921c4c:\program files\vmware\vmware tools\vmtoolsd.exe exapil\pil-cb7-2 2020-10-16T00:35:55.328Z 1576 NT AUTHORITY\SYSTEM 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-004 2020-10-05T02:16:18.531Z 2748 NT AUTHORITY\SYSTEM aca121d48147ff717bcd1da7871a5a76,
da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19adc:\program files\vmware\vmware tools\vmtoolsd.exe desktop-fvb88fs 2020-09-03T10:59:48.345Z 2892 NT AUTHORITY\SYSTEM aca121d48147ff717bcd1da7871a5a76,
da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19adc:\program files\vmware\vmware tools\vmtoolsd.exe desktop-fvb88fs 2020-09-03T08:00:46.548Z 2892 NT AUTHORITY\SYSTEM 80abd555c1869baaff2d8a8d535ce07e,
fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504c:\program files\vmware\vmware tools\vmtoolsd.exe desktop-aa2m6ld 2020-08-26T16:06:50.813Z 2016 DESKTOP-AA2M6LD\John Doe 80abd555c1869baaff2d8a8d535ce07e,
fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504c:\program files\vmware\vmware tools\vmtoolsd.exe desktop-aa2m6ld 2020-08-17T14:37:19.963Z 8052 DESKTOP-AA2M6LD\John Doe
cb-eedr-add-threat-tags
Update threat ID tags.
Base Command
cb-eedr-add-threat-tags
Input
| Argument Name | Description | Required |
|---|---|---|
| threat_id | Threat ID. | Required |
| tags | Comma-separated list of tags. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Threat.ThreatID | unknown | Threat ID. |
| CarbonBlackEEDR.Threat.Tags | unknown | Threat ID tags. |
cb-eedr-add-threat-notes
Update threat ID notes.
Base Command
cb-eedr-add-threat-notes
Input
| Argument Name | Description | Required |
|---|---|---|
| threat_id | Threat ID. | Required |
| notes | Notes to be added to the provided threat ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Threat.ThreatID | unknown | Threat ID. |
| CarbonBlackEEDR.Threat.Notes | unknown | Threat ID notes. |
cb-eedr-add-alert-notes
Update alert ID notes.
Base Command
cb-eedr-add-alert-notes
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | Alert ID to add the notes to. | Required |
| notes | Notes to be added to the provided alert ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Alert.AlertID | unknown | The alert ID. |
| CarbonBlackEEDR.Alert.Notes | unknown | Alert notes. |
cb-eedr-get-threat-tags
Output a list of tags for the provided threat ID.
Base Command
cb-eedr-get-threat-tags
Input
| Argument Name | Description | Required |
|---|---|---|
| threat_id | The threat ID for which we wish to get the tags. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Threat.ThreatID | unknown | Threat ID. |
| CarbonBlackEEDR.Threat.Tags | unknown | Threat tags. |
cb-eedr-list-alerts
Returns a list of alerts.
Base Command
cb-eedr-list-alerts
Input
| Argument Name | Description | Required |
|---|---|---|
| minimum_severity | Alert minimum severity (In range of 1-10). | Optional |
| device_os_version | Device OS version. Supports comma-separated values. | Optional |
| policy_id | The policy ID. Supports comma-separated values. | Optional |
| alert_tag | Alert tags. Supports comma-separated values. | Optional |
| alert_id | Alert ID. Supports comma-separated values. | Optional |
| device_username | Device username. Supports comma-separated values. | Optional |
| device_id | Device ID. Supports comma-separated values. | Optional |
| device_os | Device OS. Supports comma-separated values. | Optional |
| process_sha256 | Process SHA256. Supports comma-separated values. | Optional |
| policy_name | Policy name. Supports comma-separated values. | Optional |
| reputation | Alert reputation. Supports comma-separated values. | Optional |
| alert_type | Alert type. Supports comma-separated values. | Optional |
| device_name | A comma-separated list of device names. Examples- “C:\Users\example_user\Example” or “/home/example_user/Example”. | Optional |
| process_name | A comma-separated list of process names. Examples- “C:\Users\example_user\Example” or “/home/example_user/Example”. | Optional |
| sort_field | Field by which to sort the results. Possible values are: first_event_timestamp, last_event_timestamp. Default is first_event_timestamp. | Optional |
| sort_order | How to order the results. Can be “ASC” (ascending) or “DESC” (descending). Possible values are: ASC, DESC. Default is DESC. | Optional |
| limit | The maximum number of results to return. Default is 10. | Optional |
| start_time | Alert start time. | Optional |
| end_time | Alert end time. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.Alert.threat_id | String | Threat ID. |
| CarbonBlackEEDR.Alert.first_event_time | Date | First event time. |
| CarbonBlackEEDR.Alert.target_value | String | Alert target value. |
| CarbonBlackEEDR.Alert.reason | String | Alert reason. |
| CarbonBlackEEDR.Alert.org_key | String | Organization key. |
| CarbonBlackEEDR.Alert.device_id | String | Device ID. |
| CarbonBlackEEDR.Alert.report_id | String | Report ID. |
| CarbonBlackEEDR.Alert.watchlists.id | String | Watchlist ID. |
| CarbonBlackEEDR.Alert.watchlists.name | String | Watchlist name. |
| CarbonBlackEEDR.Alert.device_os_version | String | Device OS version. |
| CarbonBlackEEDR.Alert.threat_cause_threat_category | String | Threat cause threat category. |
| CarbonBlackEEDR.Alert.policy_id | String | Policy ID. |
| CarbonBlackEEDR.Alert.threat_indicators.process_name | String | Threat indicator - process name. |
| CarbonBlackEEDR.Alert.threat_indicators.sha256 | String | Indicator SHA256 hash. |
| CarbonBlackEEDR.Alert.threat_cause_actor_sha256 | String | Threat cause actor SHA256. |
| CarbonBlackEEDR.Alert.device_os | String | Device OS. |
| CarbonBlackEEDR.Alert.document_guid | String | Document GUID. |
| CarbonBlackEEDR.Alert.create_time | Date | Alert create time. |
| CarbonBlackEEDR.Alert.threat_cause_actor_name | String | Threat cause actor name. |
| CarbonBlackEEDR.Alert.ioc_hit | String | IOC hit. |
| CarbonBlackEEDR.Alert.threat_cause_reputation | String | Threat cause reputation. |
| CarbonBlackEEDR.Alert.legacy_alert_id | String | Legacy alert ID. |
| CarbonBlackEEDR.Alert.device_name | String | Device name. |
| CarbonBlackEEDR.Alert.report_name | String | Report name. |
| CarbonBlackEEDR.Alert.policy_name | String | Policy name. |
| CarbonBlackEEDR.Alert.ioc_field | String | IOC field. |
| CarbonBlackEEDR.Alert.tags | String | Alert tags. |
| CarbonBlackEEDR.Alert.process_guid | String | Process GUID. |
| CarbonBlackEEDR.Alert.threat_cause_actor_md5 | String | Threat cause actor MD5 hash. |
| CarbonBlackEEDR.Alert.last_update_time | Date | Alert last updated time. |
| CarbonBlackEEDR.Alert.type | String | Alert type. |
| CarbonBlackEEDR.Alert.id | String | Alert ID. |
| CarbonBlackEEDR.Alert.process_name | String | Process name. |
| CarbonBlackEEDR.Alert.last_event_time | Date | Alert last event time. |
| CarbonBlackEEDR.Alert.ioc_id | String | IOC ID. |
| CarbonBlackEEDR.Alert.notes_present | Boolean | Whether notes are present. |
| CarbonBlackEEDR.Alert.run_state | String | Alert run state. |
| CarbonBlackEEDR.Alert.severity | Number | Alert severity. |
| CarbonBlackEEDR.Alert.threat_cause_vector | String | Threat cause vector. |
| CarbonBlackEEDR.Alert.device_username | String | Device username. |
| CarbonBlackEEDR.Alert.workflow.changed_by | String | Alert workflow - changed by. |
| CarbonBlackEEDR.Alert.workflow.comment | String | Alert workflow - comment. |
| CarbonBlackEEDR.Alert.workflow.last_update_time | Date | Alert workflow - last updated time. |
| CarbonBlackEEDR.Alert.workflow.remediation | String | Alert workflow - remediation. |
| CarbonBlackEEDR.Alert.workflow.state | String | Alert workflow state. |
cb-eedr-process-search
Creates a process search job and returns results if ‘polling’ argument is True.
Base Command
cb-eedr-process-search
Input
| Argument Name | Description | Required |
|---|---|---|
| process_name | The process name to search. | Optional |
| process_hash | The process hash to search. | Optional |
| event_id | The event ID to search. | Optional |
| limit | The maximum number of rows to return. Default is 20. | Optional |
| query | A free-style query. For example, “process_name:svchost.exe”. | Optional |
| start_time | First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. | Optional |
| end_time | Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. | Optional |
| start | Index of first records to fetch. Default is 0. | Optional |
| job_id | Job ID to retrieve. | Optional |
| polling | whether to run the command with polling. Possible values are: true, false. Default is True. | Optional |
| interval_in_seconds | The time in seconds to wait between polling. Default is 60. | Optional |
| time_out | The timeout duration in seconds for polling retries. Default is 600. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CarbonBlackEEDR.SearchProcess.job_id | String | The ID of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.status | String | The status of the job found by the search. |
| CarbonBlackEEDR.SearchProcess.results.device_id | Number | The device ID that is guaranteed to be unique within each PSC environment. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | The user names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.backend_timestamp | Date | A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. |
| CarbonBlackEEDR.SearchProcess.results.childproc_count | Number | The cumulative count of child-process creations since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.crossproc_count | Number | The cumulative count of cross-process events since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.device_group_id | Number | The ID of the sensor group where the device belongs. |
| CarbonBlackEEDR.SearchProcess.results.device_name | String | The name of the device. |
| CarbonBlackEEDR.SearchProcess.results.device_policy_id | Number | The ID of the policy applied to the device. |
| CarbonBlackEEDR.SearchProcess.results.device_timestamp | Date | The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. |
| CarbonBlackEEDR.SearchProcess.results.enriched | Boolean | True if the process document came from the CBD data stream. |
| CarbonBlackEEDR.SearchProcess.results.enriched_event_type | String | The CBD enriched event type. |
| CarbonBlackEEDR.SearchProcess.results.event_type | String | The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL. |
| CarbonBlackEEDR.SearchProcess.results.filemod_count | Number | The cumulative count of file modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.ingress_time | Date | Unknown |
| CarbonBlackEEDR.SearchProcess.results.legacy | Boolean | True if the process document came from the legacy data stream (deprecated, use enriched). |
| CarbonBlackEEDR.SearchProcess.results.modload_count | Number | The cumulative count of module loads since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.netconn_count | Number | The cumulative count of network connections since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.org_id | String | The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments. |
| CarbonBlackEEDR.SearchProcess.results.parent_guid | String | The process GUID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.parent_pid | Number | The PID of the parent process. |
| CarbonBlackEEDR.SearchProcess.results.process_guid | String | Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based). |
| CarbonBlackEEDR.SearchProcess.results.process_hash | String | The MD5 and SHA-256 hashes of the process’s main module in a multi-valued field. |
| CarbonBlackEEDR.SearchProcess.results.process_name | String | The tokenized file path of the process’s main module. |
| CarbonBlackEEDR.SearchProcess.results.process_pid | Number | The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. |
| CarbonBlackEEDR.SearchProcess.results.process_username | String | User names related to the process. |
| CarbonBlackEEDR.SearchProcess.results.regmod_count | Number | The cumulative count of registry modifications since process tracking started. |
| CarbonBlackEEDR.SearchProcess.results.scriptload_count | Number | The cumulative count of loaded scripts since process tracking started. |
Troubleshooting
Note: If the API returns duplicates, the duplicates will be dropped, causing the total number of alerts fetched to potentially be fewer than the set limit. Moreover, if all of the alerts returned are duplicates, they will all be dropped, causing no alerts to be returned. In such cases, increase the limit.
Configuration parameters
url— Server URL (e.g. https://defense.conferdeploy.net) (required)organization_key— Organization Key (required)custom_key— Custom Keycustom_id— Custom IDcredentials_custom— Custom IDisFetch— Fetch incidentsincidentType— Incident typeinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsfetch_time— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)fetch_limit— Fetch limitincidentFetchInterval— Incidents Fetch Interval
Commands (39)
-
cb-eedr-add-alert-notesUpdate alert ID notes.
-
cb-eedr-add-threat-notesUpdate threat ID notes.
-
cb-eedr-add-threat-tagsUpdate threat ID tags.
-
cb-eedr-alert-workflow-updateUpdates the workflow of a single alert.
-
cb-eedr-device-background-scanStart a background scan on device.
-
cb-eedr-device-background-scan-stopStops a background scan on the specified devices.
-
cb-eedr-device-bypassEnable a bypass on device.
-
cb-eedr-device-policy-updateUpdate device policy.
-
cb-eedr-device-quarantineQuarantines a device.
-
cb-eedr-device-unbypassDisable a bypass on device.
-
cb-eedr-device-unquarantineRemoves a device from quarantine.
-
cb-eedr-devices-listList devices based on the search query.
-
cb-eedr-events-by-process-getRetrieves the events associated with a given process.
-
cb-eedr-file-device-summaryGets an overview of the devices that executed the file.
-
cb-eedr-file-pathsReturn a summary of the observed file paths.
-
cb-eedr-files-download-link-getThe files are able to be downloaded via AWS S3 pre-signed URLs.
-
cb-eedr-get-file-metadataReturns all of the metadata for the specified binary identified by the SHA256 hash.
-
cb-eedr-get-threat-tagsOutput a list of tags for the provided threat ID.
-
cb-eedr-get-watchlist-by-idGets watchlist information by watchlist ID.
-
cb-eedr-ioc-ignoreIOC ioc_id for report report_id will not match future events for any watchlist.
-
cb-eedr-ioc-ignore-statusGets the current ignore status for IOC ioc_id in report report_id.
-
cb-eedr-ioc-reactivateIOC ioc_id for report report_id will match future events for all watchlists.
-
cb-eedr-list-alertsReturns a list of alerts.
-
cb-eedr-process-searchCreates a process search job and returns results if 'polling' argument is True.
-
cb-eedr-process-search-resultsRetrieves the process search results for a given job ID.
-
cb-eedr-report-createAdds a new watchlist report.
-
cb-eedr-report-getRetrieves the specified report.
-
cb-eedr-report-ignoreReport with report_id and all contained IOCs will not match future events for any watchlist.
-
cb-eedr-report-ignore-statusGet current ignore status for report with report_id.
-
cb-eedr-report-reactivateReport with report_id and all contained IOCs will match future events for all watchlists.
-
cb-eedr-report-removeRemove report with report_id.
-
cb-eedr-report-updateUpdates the specified report.
-
cb-eedr-watchlist-alerts-disableTurns off alerts for the watchlist with the specified watchlist ID.
-
cb-eedr-watchlist-alerts-enableTurns on alerts for the watchlist with the specified watchlist ID.
-
cb-eedr-watchlist-alerts-statusRetrieves the alert status for the watchlist with given watchlist ID.
-
cb-eedr-watchlist-createCreates a new report or classifier watchlist.
-
cb-eedr-watchlist-deleteRemoves the specified watchlist.
-
cb-eedr-watchlist-listRetrieves all watchlists.
-
cb-eedr-watchlist-updateUpdates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist.
category: Endpoint provider: Broadcom sectionorder: - Connect - Collect commonfields: id: Carbon Black Enterprise EDR version: -1 configuration: - display: Server URL (e.g. https://defense.conferdeploy.net) name: url required: true type: 0 section: Connect - display: Organization Key name: organization_key required: true type: 0 section: Connect - display: Custom Key name: custom_key type: 4 section: Connect hidden: true required: false - display: Custom ID name: custom_id type: 0 section: Connect hidden: true required: false - display: Custom ID name: credentials_custom type: 9 displaypassword: Custom Key section: Connect required: false - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Incident type name: incidentType type: 13 section: Connect required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - defaultvalue: '3 days' display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) name: fetch_time type: 0 section: Collect required: false - defaultvalue: '50' display: Fetch limit name: fetch_limit type: 0 section: Collect required: false additionalinfo: If the API returns duplicates, the duplicates will be dropped, causing the total number of alerts fetched to potentially be fewer than the set limit. - defaultvalue: "1" display: Incidents Fetch Interval name: incidentFetchInterval required: false section: Collect type: 19 description: VMware Carbon Black Enterprise EDR (formerly known as Carbon Black ThreatHunter) is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter). display: Carbon Black Enterprise EDR name: Carbon Black Enterprise EDR script: commands: - arguments: - description: The ID of the alert to update. Get the ID from list-alerts command. name: alert_id required: true - auto: PREDEFINED description: Workflow state to update. name: state predefined: - IN_PROGRESS - CLOSED - DISMISSED - OPEN - description: Value judgement of whether the alert(s) represent a true or false positive. name: remediation_state auto: PREDEFINED predefined: - TRUE_POSITIVE - FALSE_POSITIVE - NONE - description: Relative time range for the request. Should not be provided if using `start` and `end` arguments. name: time_range defaultValue: -2w - name: start description: The lower bound of the time range. Requires end and must be a timestamp before end. - name: end description: The upper bound of the time range. Requires start and must be a timestamp after start. - name: closure_reason description: The closure reason. auto: PREDEFINED predefined: - NO_REASON - RESOLVED - RESOLVED_BENIGN_KNOWN_GOOD - DUPLICATE_CLEANUP - OTHER - description: Comment to include with the operation. name: comment - description: Request ID to retrieve. name: request_id hidden: true description: Updates the workflow of a single alert. name: cb-eedr-alert-workflow-update outputs: - contextPath: CarbonBlackEEDR.Alert.AlertID description: The alert ID. type: String - contextPath: CarbonBlackEEDR.Alert.ChangedBy description: User that changed the ID. type: String - contextPath: CarbonBlackEEDR.Alert.Comment description: Comment that was included with the operation. type: String - contextPath: CarbonBlackEEDR.Alert.LastUpdateTime description: Last time the alert was updated. type: Date - contextPath: CarbonBlackEEDR.Alert.Remediation description: Description or justification for the change. type: String - contextPath: CarbonBlackEEDR.Alert.State description: The alert state. type: String polling: true - arguments: - description: The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. name: device_id required: true description: Quarantines a device. name: cb-eedr-device-quarantine - arguments: - description: The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. isArray: true name: device_id required: true description: Removes a device from quarantine. name: cb-eedr-device-unquarantine - arguments: - description: The device ID. Get the ID from the devices-list command. Supports comma-separated values. name: device_id required: true description: Stops a background scan on the specified devices. name: cb-eedr-device-background-scan-stop - arguments: - description: The device ID. Get the ID from the devices-list command. Supports comma-separated values. name: device_id required: true description: Start a background scan on device. name: cb-eedr-device-background-scan - arguments: - description: The device ID. Get the ID from the devices-list command. Support comma-separated values. name: device_id required: true description: Enable a bypass on device. name: cb-eedr-device-bypass - arguments: - description: The device ID. Get the ID from the devices-list command. Support comma-separated values. name: device_id required: true description: Disable a bypass on device. name: cb-eedr-device-unbypass - arguments: - description: The device ID. Get the ID from the devices-list command. Support comma-separated values. name: device_id required: true - description: The policy ID. name: policy_id required: true description: Update device policy. name: cb-eedr-device-policy-update - arguments: - description: The device ID. Supports comma-separated values. name: device_id - auto: PREDEFINED description: The device status. Supports comma-separated values. name: status predefined: - PENDING - REGISTERED - UNINSTALLED - DEREGISTERED - ACTIVE - INACTIVE - ERROR - ALL - BYPASS_ON - BYPASS - QUARANTINE - SENSOR_OUTOFDATE - DELETED - LIVE - description: Device operation system. Supports comma-separated values. name: device_os - description: 'Device start last contact time. For example: 2019-01-01T11:00:00.157Z.' name: start_time - description: 'Device end last contact time. For example: 2019-01-01T11:00:00.157Z.' name: end_time - description: Active directory group ID. Supports comma-separated values. name: ad_group_id - description: The policy ID. Supports comma-separated values. name: policy_id - auto: PREDEFINED description: Device target priority. Supports comma-separated values. name: target_priority predefined: - LOW - MEDIUM - HIGH - MISSION_CRITICAL - defaultValue: '20' description: Maximum number of rows to return. name: limit - auto: PREDEFINED defaultValue: last_contact_time description: Sort Fields. name: sort_field predefined: - target_priority - policy_name - name - last_contact_time - av_pack_version - auto: PREDEFINED defaultValue: DESC description: Sort Order for field. name: sort_order predefined: - ASC - DESC description: List devices based on the search query. name: cb-eedr-devices-list outputs: - contextPath: CarbonBlackEEDR.Device.sensor_out_of_date description: Is the device sensor out of date. type: Boolean - contextPath: CarbonBlackEEDR.Device.vdi_base_device description: vdi base device. type: String - contextPath: CarbonBlackEEDR.Device.linux_kernel_version description: Linux kernel version. type: String - contextPath: CarbonBlackEEDR.Device.mac_address description: Device MAC address. type: String - contextPath: CarbonBlackEEDR.Device.os description: Device operating system. type: String - contextPath: CarbonBlackEEDR.Device.last_device_policy_changed_time description: Last device policy changed time. type: Date - contextPath: CarbonBlackEEDR.Device.last_reset_time description: Last reset time. type: Date - contextPath: CarbonBlackEEDR.Device.sensor_states description: Device sensor state. type: String - contextPath: CarbonBlackEEDR.Device.last_external_ip_address description: Last external IP address. type: String - contextPath: CarbonBlackEEDR.Device.organization_id description: Organization ID. type: Number - contextPath: CarbonBlackEEDR.Device.sensor_kit_type description: Sensor kit type. type: String - contextPath: CarbonBlackEEDR.Device.policy_id description: Device policy ID. type: Number - contextPath: CarbonBlackEEDR.Device.login_user_name description: Login user name. type: String - contextPath: CarbonBlackEEDR.Device.deregistered_time description: Deregistered time. type: Date - contextPath: CarbonBlackEEDR.Device.registered_time description: Registered time. type: Date - contextPath: CarbonBlackEEDR.Device.name description: Device name. type: String - contextPath: CarbonBlackEEDR.Device.last_device_policy_requested_time description: Last device policy requested time. type: Date - contextPath: CarbonBlackEEDR.Device.scan_last_complete_time description: Scan last complete time. type: Date - contextPath: CarbonBlackEEDR.Device.last_shutdown_time description: Last shutdown time. type: Date - contextPath: CarbonBlackEEDR.Device.scan_last_action_time description: Device scan last action time. type: String - contextPath: CarbonBlackEEDR.Device.windows_platform description: Windows platform. type: String - contextPath: CarbonBlackEEDR.Device.last_reported_time description: Device last reported time. type: Date - contextPath: CarbonBlackEEDR.Device.device_owner_id description: Device owner ID. type: Number - contextPath: CarbonBlackEEDR.Device.target_priority description: Target priority. type: String - contextPath: CarbonBlackEEDR.Device.status description: Device status. type: String - contextPath: CarbonBlackEEDR.Device.sensor_version description: Sensor version. type: String - contextPath: CarbonBlackEEDR.Device.virtual_machine description: Is the device virtual machine. type: Boolean - contextPath: CarbonBlackEEDR.Device.last_name description: Last name. type: String - contextPath: CarbonBlackEEDR.Device.scan_status description: Scan status. type: String - contextPath: CarbonBlackEEDR.Device.last_internal_ip_address description: Last internal IP address. type: String - contextPath: CarbonBlackEEDR.Device.last_policy_updated_time description: Last policy updated time. type: Date - contextPath: CarbonBlackEEDR.Device.last_contact_time description: Device last contact time. type: Date - contextPath: CarbonBlackEEDR.Device.quarantined description: Is the device quarantined. type: Boolean - contextPath: CarbonBlackEEDR.Device.virtualization_provider description: Virtualization Provider. type: String - contextPath: CarbonBlackEEDR.Device.organization_name description: Organization Name. type: String - contextPath: CarbonBlackEEDR.Device.ad_group_id description: Active directory group ID. type: String - contextPath: CarbonBlackEEDR.Device.policy_name description: Policy name. type: String - contextPath: CarbonBlackEEDR.Device.policy_override description: Policy override. type: Boolean - contextPath: CarbonBlackEEDR.Device.first_name description: First name. type: String - contextPath: CarbonBlackEEDR.Device.current_sensor_policy_name description: Current sensor policy name. type: String - contextPath: CarbonBlackEEDR.Device.id description: Device ID. type: String - contextPath: CarbonBlackEEDR.Device.av_status description: av status. type: String - contextPath: CarbonBlackEEDR.Device.av_pack_version description: av pack version. type: String - contextPath: CarbonBlackEEDR.Device.email description: User email. type: String - contextPath: CarbonBlackEEDR.Device.os_version description: Device OS version. type: String - contextPath: CarbonBlackEEDR.Device.av_product_version description: AV product version. type: String - contextPath: CarbonBlackEEDR.Device.last_location description: Device last location. type: String - contextPath: Endpoint.ID description: The unique ID within the tool retrieving the endpoint. type: String - contextPath: Endpoint.OS description: Endpoint OS. type: String - contextPath: Endpoint.OSVersion description: OS version. type: String - contextPath: Endpoint.MACAddress description: The MAC address of the endpoint. type: String - arguments: - description: Alert minimum severity (In range of 1-10). name: minimum_severity - description: Device OS version. Supports comma-separated values. name: device_os_version - description: The policy ID. Supports comma-separated values. name: policy_id - description: Alert tags. Supports comma-separated values. name: alert_tag - description: Alert ID. Supports comma-separated values. name: alert_id - description: Device username. Supports comma-separated values. name: device_username - description: Device ID. Supports comma-separated values. name: device_id - description: Device OS. Supports comma-separated values. name: device_os - description: Process SHA256. Supports comma-separated values. name: process_sha256 - description: Policy name. Supports comma-separated values. name: policy_name - description: Alert reputation. Supports comma-separated values. name: reputation - description: Alert type. Supports comma-separated values. name: alert_type - description: A comma-separated list of device names. Examples- "C:\\Users\\example_user\\Example" or "/home/example_user/Example". name: device_name - description: A comma-separated list of process names. Examples- "C:\\Users\\example_user\\Example" or "/home/example_user/Example". name: process_name - description: Field by which to sort the results. name: sort_field auto: PREDEFINED defaultValue: first_event_timestamp predefined: - first_event_timestamp - last_event_timestamp - description: How to order the results. Can be "ASC" (ascending) or "DESC" (descending). name: sort_order auto: PREDEFINED defaultValue: DESC predefined: - ASC - DESC - description: The maximum number of results to return. name: limit defaultValue: '10' - description: Alert start time. name: start_time - description: Alert end time. name: end_time description: Returns a list of alerts. name: cb-eedr-list-alerts outputs: - contextPath: CarbonBlackEEDR.Alert.threat_id description: Threat ID. type: String - contextPath: CarbonBlackEEDR.Alert.first_event_time description: First event time. type: Date - contextPath: CarbonBlackEEDR.Alert.target_value description: Alert target value. type: String - contextPath: CarbonBlackEEDR.Alert.reason description: Alert reason. type: String - contextPath: CarbonBlackEEDR.Alert.org_key description: Organization key. type: String - contextPath: CarbonBlackEEDR.Alert.device_id description: Device ID. type: String - contextPath: CarbonBlackEEDR.Alert.report_id description: Report ID. type: String - contextPath: CarbonBlackEEDR.Alert.watchlists.id description: Watchlist ID. type: String - contextPath: CarbonBlackEEDR.Alert.watchlists.name description: Watchlist name. type: String - contextPath: CarbonBlackEEDR.Alert.device_os_version description: Device OS version. type: String - contextPath: CarbonBlackEEDR.Alert.threat_cause_threat_category description: Threat cause threat category. type: String - contextPath: CarbonBlackEEDR.Alert.policy_id description: Policy ID. type: String - contextPath: CarbonBlackEEDR.Alert.threat_indicators.process_name description: Threat indicator - process name. type: String - contextPath: CarbonBlackEEDR.Alert.threat_indicators.sha256 description: Indicator SHA256 hash. type: String - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_sha256 description: Threat cause actor SHA256. type: String - contextPath: CarbonBlackEEDR.Alert.device_os description: Device OS. type: String - contextPath: CarbonBlackEEDR.Alert.document_guid description: Document GUID. type: String - contextPath: CarbonBlackEEDR.Alert.create_time description: Alert create time. type: Date - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_name description: Threat cause actor name. type: String - contextPath: CarbonBlackEEDR.Alert.ioc_hit description: IOC hit. type: String - contextPath: CarbonBlackEEDR.Alert.threat_cause_reputation description: Threat cause reputation. type: String - contextPath: CarbonBlackEEDR.Alert.legacy_alert_id description: Legacy alert ID. type: String - contextPath: CarbonBlackEEDR.Alert.device_name description: Device name. type: String - contextPath: CarbonBlackEEDR.Alert.report_name description: Report name. type: String - contextPath: CarbonBlackEEDR.Alert.policy_name description: Policy name. type: String - contextPath: CarbonBlackEEDR.Alert.ioc_field description: IOC field. type: String - contextPath: CarbonBlackEEDR.Alert.tags description: Alert tags. type: String - contextPath: CarbonBlackEEDR.Alert.process_guid description: Process GUID. type: String - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_md5 description: Threat cause actor MD5 hash. type: String - contextPath: CarbonBlackEEDR.Alert.last_update_time description: Alert last updated time. type: Date - contextPath: CarbonBlackEEDR.Alert.type description: Alert type. type: String - contextPath: CarbonBlackEEDR.Alert.id description: Alert ID. type: String - contextPath: CarbonBlackEEDR.Alert.process_name description: Process name. type: String - contextPath: CarbonBlackEEDR.Alert.last_event_time description: Alert last event time. type: Date - contextPath: CarbonBlackEEDR.Alert.ioc_id description: IOC ID. type: String - contextPath: CarbonBlackEEDR.Alert.notes_present description: Whether notes are present. type: Boolean - contextPath: CarbonBlackEEDR.Alert.run_state description: Alert run state. type: String - contextPath: CarbonBlackEEDR.Alert.severity description: Alert severity. type: Number - contextPath: CarbonBlackEEDR.Alert.threat_cause_vector description: Threat cause vector. type: String - contextPath: CarbonBlackEEDR.Alert.device_username description: Device username. type: String - contextPath: CarbonBlackEEDR.Alert.workflow.changed_by description: Alert workflow - changed by. type: String - contextPath: CarbonBlackEEDR.Alert.workflow.comment description: Alert workflow - comment. type: String - contextPath: CarbonBlackEEDR.Alert.workflow.last_update_time description: Alert workflow - last updated time. type: Date - contextPath: CarbonBlackEEDR.Alert.workflow.remediation description: Alert workflow - remediation. type: String - contextPath: CarbonBlackEEDR.Alert.workflow.state description: Alert workflow state. type: String - description: Retrieves all watchlists. name: cb-eedr-watchlist-list outputs: - contextPath: CarbonBlackEEDR.Watchlist.classifier description: Watchlist classifier. type: String - contextPath: CarbonBlackEEDR.Watchlist.last_update_timestamp description: Watchlist last updated timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.name description: Watchlist name. type: String - contextPath: CarbonBlackEEDR.Watchlist.report_ids description: Watchlist report IDs. type: String - contextPath: CarbonBlackEEDR.Watchlist.create_timestamp description: Watchlist created timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.id description: Watchlist ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.tags_enabled description: Whether tags are enabled for the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.description description: Watchlist description. type: String arguments: [] - arguments: - description: The watchlist ID. Get the ID from the watchlist-list command. name: watchlist_id required: true description: Gets watchlist information by watchlist ID. name: cb-eedr-get-watchlist-by-id outputs: - contextPath: CarbonBlackEEDR.Watchlist.classifier description: Watchlist classifier. type: String - contextPath: CarbonBlackEEDR.Watchlist.last_update_timestamp description: Watchlist last updated timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.name description: Watchlist name. type: String - contextPath: CarbonBlackEEDR.Watchlist.report_ids description: Watchlist report IDs. type: String - contextPath: CarbonBlackEEDR.Watchlist.create_timestamp description: Watchlist created timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.id description: Watchlist ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.tags_enabled description: Whether tags are enabled for the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.description description: Watchlist description. type: String - contextPath: CarbonBlackEEDR.Watchlist.Aaerts_enabled description: Whether alerts are enabled for the watchlists. type: Boolean - arguments: - description: The watchlist ID. Get the ID from the watchlist-list command. name: watchlist_id required: true description: Retrieves the alert status for the watchlist with given watchlist ID. name: cb-eedr-watchlist-alerts-status - arguments: - description: The watchlist ID. Get the ID from the watchlist-list command. name: watchlist_id required: true description: Turns on alerts for the watchlist with the specified watchlist ID. name: cb-eedr-watchlist-alerts-enable - arguments: - description: The watchlist ID. Get the ID from the watchlist-list command. name: watchlist_id required: true description: Turns off alerts for the watchlist with the specified watchlist ID. name: cb-eedr-watchlist-alerts-disable - arguments: - description: The name of the watchlist. name: watchlist_name required: true - description: The watchlist description. name: description - auto: PREDEFINED description: Whether to enable watchlist tags. Can be "true" or "false". name: tags_enabled predefined: - 'true' - 'false' - auto: PREDEFINED description: Enable watchlist alerts. name: alerts_enabled predefined: - 'true' - 'false' - description: The report IDs for creating the watchlist. Supports comma-separated values. name: report_ids - description: The classifier key for creating the watchlist. name: classifier_key - description: The classifier value for creating the watchlist. name: classifier_value description: Creates a new report or classifier watchlist. name: cb-eedr-watchlist-create outputs: - contextPath: CarbonBlackEEDR.Watchlist.Classifier description: The watchlist classifier. type: String - contextPath: CarbonBlackEEDR.Watchlist.Last_update_timestamp description: Watchlist last updated timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.Name description: Watchlist name. type: String - contextPath: CarbonBlackEEDR.Watchlist.Report_ids description: Watchlist report ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.Create_timestamp description: Watchlist created timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.Alerts_enabled description: Whether alerts are enabled in the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.ID description: Watchlist ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.Tags_enabled description: Whether tags are enabled in the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.Description description: Watchlist description. type: String - arguments: - description: The watchlist ID to remove. Get the ID from the watchlist-list command. name: watchlist_id required: true description: Removes the specified watchlist. name: cb-eedr-watchlist-delete - arguments: - description: The watchlist ID to update. name: watchlist_id required: true - description: The watchlist name. name: watchlist_name required: true - description: Watchlist description. name: description - auto: PREDEFINED description: Whether to enable watchlist tags. Can be "true" or "false". name: tags_enabled predefined: - 'true' - 'false' - auto: PREDEFINED description: Enable watchlist alerts. name: alerts_enabled predefined: - 'true' - 'false' - description: Watchlist report ID. Supports comma-separated values. name: report_ids - description: The classifier key to update. name: classifier_key - description: The classifier value to update. name: classifier_value description: Updates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist. name: cb-eedr-watchlist-update outputs: - contextPath: CarbonBlackEEDR.Watchlist.Classifier description: The watchlist classifier. type: String - contextPath: CarbonBlackEEDR.Watchlist.Last_update_timestamp description: Watchlist last update timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.Name description: Watchlist name. type: String - contextPath: CarbonBlackEEDR.Watchlist.Report_ids description: Watchlist report ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.Create_timestamp description: Watchlist created timestamp. type: Date - contextPath: CarbonBlackEEDR.Watchlist.Alerts_enabled description: Whether alerts are enabled in the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.ID description: Watchlist ID. type: String - contextPath: CarbonBlackEEDR.Watchlist.Tags_enabled description: Whether tags are enabled in the watchlist. type: Boolean - contextPath: CarbonBlackEEDR.Watchlist.Description description: Watchlist description. type: String - arguments: - description: The report ID. Get the ID from the watchlist-list command. name: report_id required: true description: Retrieves the specified report. name: cb-eedr-report-get outputs: - contextPath: CarbonBlackEEDR.Report.Visibility description: Report visibility. type: String - contextPath: CarbonBlackEEDR.Report.Title description: Report title. type: String - contextPath: CarbonBlackEEDR.Report.Tags description: Report tags. type: String - contextPath: CarbonBlackEEDR.Report.Link description: Report link. type: String - contextPath: CarbonBlackEEDR.Report.ID description: Report ID. type: String - contextPath: CarbonBlackEEDR.Report.Timestamp description: Report timestamp. type: Date - contextPath: CarbonBlackEEDR.Report.Description description: Report description. type: String - contextPath: CarbonBlackEEDR.Report.Severity description: Report severity. type: Number - contextPath: CarbonBlackEEDR.Report.IOCs description: The report's IOCs. type: String - arguments: - description: Report ID. Get the ID from the watchlist-list command. name: report_id required: true - description: IOC ID. Get the ID from get_report command. name: ioc_id required: true description: Gets the current ignore status for IOC ioc_id in report report_id. name: cb-eedr-ioc-ignore-status - arguments: - description: Report ID. Get the ID from the watchlist-list command. name: report_id required: true - description: IOC ID. Get the ID from get_report command. name: ioc_id required: true description: IOC ioc_id for report report_id will not match future events for any watchlist. name: cb-eedr-ioc-ignore - arguments: - description: Report ID. Get the ID from the watchlist-list command. name: report_id required: true - description: IOC ID. Get the ID from get_report command. name: ioc_id required: true description: IOC ioc_id for report report_id will match future events for all watchlists. name: cb-eedr-ioc-reactivate - arguments: - description: The report ID. Get the ID from the watchlist-list command. name: report_id required: true description: Report with report_id and all contained IOCs will not match future events for any watchlist. name: cb-eedr-report-ignore - arguments: - description: The report ID. Get the ID from the watchlist-list command. name: report_id required: true description: Report with report_id and all contained IOCs will match future events for all watchlists. name: cb-eedr-report-reactivate - arguments: - description: The report ID. Get the ID from the watchlist-list command. name: report_id required: true description: Get current ignore status for report with report_id. name: cb-eedr-report-ignore-status - arguments: - description: The report ID to remove. Get the ID from the watchlist-list command. name: report_id required: true description: Remove report with report_id. name: cb-eedr-report-remove - arguments: - description: The report title. name: title required: true - description: The report description. name: description required: true - description: The report tags. Supports comma-separated values. name: tags - description: The report severity (In range of 1-10). name: severity required: true - description: IOCs of type IPv4. Supports comma-separated values. name: ipv4 - description: 'The IOC query for the report, for example: (netconn_ipv4:2.2.2.2). Supports comma-separated values.' name: ioc_query - description: 'The report timestamp. For example: 2020-01-19T09:16:16.' name: timestamp required: true - description: IOCs of type IPv6. Supports comma-separated values. name: ipv6 - description: IOCs of type MD5. Supports comma-separated values. name: md5 - description: IOCs of type DNS. Supports comma-separated values. name: dns description: Adds a new watchlist report. name: cb-eedr-report-create outputs: - contextPath: CarbonBlackEEDR.Report.ID description: The report ID. type: String - contextPath: CarbonBlackEEDR.Report.IOCs description: The report IOCs. type: String - contextPath: CarbonBlackEEDR.Report.Link description: Report link. type: String - contextPath: CarbonBlackEEDR.Report.Severity description: Report severity. type: Number - contextPath: CarbonBlackEEDR.Report.Timestamp description: The report timestamp. type: Date - contextPath: CarbonBlackEEDR.Report.Title description: The report title. type: String - contextPath: CarbonBlackEEDR.Report.Tags description: Report tags. type: String - contextPath: CarbonBlackEEDR.Report.Visibility description: Report visibility. type: String - contextPath: CarbonBlackEEDR.Report.Description description: The report description. type: String - arguments: - description: The report ID to update. name: report_id required: true - description: The report title. name: title required: true - description: The report description. name: description required: true - description: The report tags. Supports comma-separated values. name: tags - description: IOC of type IPv4. Supports comma-separated values. name: ipv4 - description: IOC of type IPv6. Supports comma-separated values. name: ipv6 - description: IOC of type DNS. Supports comma-separated values. name: dns - description: IOC of type MD5. Supports comma-separated values. name: md5 - description: 'Query IOC. For example: (netconn_ipv4:2.2.2.2). Supports comma-separated values.' name: ioc_query - description: Report severity (In range of 1-10). name: severity required: true - description: The report timestamp. name: timestamp required: true description: Updates the specified report. name: cb-eedr-report-update outputs: - contextPath: CarbonBlackEEDR.Report.ID description: The report ID. type: String - contextPath: CarbonBlackEEDR.Report.IOCs description: The report IOC's. type: String - contextPath: CarbonBlackEEDR.Report.Link description: Report link. type: String - contextPath: CarbonBlackEEDR.Report.Severity description: Report severity. type: Number - contextPath: CarbonBlackEEDR.Report.Timestamp description: The report timestamp. type: Date - contextPath: CarbonBlackEEDR.Report.Title description: The report title. type: String - contextPath: CarbonBlackEEDR.Report.Tags description: Report tags. type: String - contextPath: CarbonBlackEEDR.Report.Visibility description: Report visibility. type: String - contextPath: CarbonBlackEEDR.Report.Description description: The report description. type: String - arguments: - description: The requested SHA256 hash to obtain information for. name: sha256 required: true description: Gets an overview of the devices that executed the file. name: cb-eedr-file-device-summary outputs: - contextPath: CarbonBlackEEDR.File.first_seen_device_id description: The device ID of the device that first saw this file. type: Number - contextPath: CarbonBlackEEDR.File.first_seen_device_name description: The name of the device that first saw this file. type: String - contextPath: CarbonBlackEEDR.File.first_seen_device_timestamp description: The time that this file was first seen, for this organization. type: Date - contextPath: CarbonBlackEEDR.File.last_seen_device_id description: The device ID of the device that most recently saw this file. type: Number - contextPath: CarbonBlackEEDR.File.last_seen_device_name description: The name of the device that last saw this file. type: String - contextPath: CarbonBlackEEDR.File.last_seen_device_timestamp description: The time that this file was most recently seen for this organization. type: Date - contextPath: CarbonBlackEEDR.File.num_devices description: The total number of devices, for this organization, that have observed this file. type: Number - contextPath: CarbonBlackEEDR.File.sha256 description: The SHA256 hash of the file. type: String - arguments: - description: The requested SHA256 hash to obtain metadata information. name: sha256 required: true description: Returns all of the metadata for the specified binary identified by the SHA256 hash. name: cb-eedr-get-file-metadata outputs: - contextPath: CarbonBlackEEDR.File.file_size description: The size of the actual file. This is the size of the file represented by this hash. type: Number - contextPath: CarbonBlackEEDR.File.file_available description: If true, the file is available for download. type: Boolean - contextPath: CarbonBlackEEDR.File.sha256 description: The SHA256 hash of the file. type: String - contextPath: CarbonBlackEEDR.File.product_version description: Product version from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.product_description description: Product description from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.lang_id description: The Language ID value from the Windows VERSIONINFO resource. type: String - contextPath: CarbonBlackEEDR.File.company_name description: Company name from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.internal_name description: Internal name from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.charset_id description: The Character set ID value from the Windows VERSIONINFO resource. type: Number - contextPath: CarbonBlackEEDR.File.available_file_size description: The size of the file, that is available for download. If the file is unavailable the size will be zero. type: Number - contextPath: CarbonBlackEEDR.File.architecture description: 'The set of architectures that this file was compiled for. This may contain one or more of the following values: none, x86, amd64, and arm64.' type: String - contextPath: CarbonBlackEEDR.File.comments description: Comments from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.os_type description: 'The OS that this file is designed for. This may contain one or more of the following values: WINDOWS, ANDROID, MAC, IOS, LINUX, and OTHER.' type: String - contextPath: CarbonBlackEEDR.File.original_filename description: Original filename from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.file_version description: File version from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.file_description description: File description from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.product_name description: Product name from FileVersionInformation. type: String - contextPath: CarbonBlackEEDR.File.md5 description: The MD5 hash of the file. type: String - arguments: - description: An array of SHA256 hashes (limit 100). Supports comma-separated values. name: sha256 required: true - defaultValue: '300' description: The number of seconds to make the download URLs available for. name: expiration_seconds - auto: PREDEFINED defaultValue: 'false' description: Download the file to XSOAR. name: download_to_xsoar predefined: - 'true' - 'false' description: The files are able to be downloaded via AWS S3 pre-signed URLs. name: cb-eedr-files-download-link-get outputs: - contextPath: CarbonBlackEEDR.File.found.sha256 description: SHA256 hash of file that is available to be downloaded. type: String - contextPath: CarbonBlackEEDR.File.found.url description: An AWS S3 pre-signed URL for this file. Perform a GET on this URL to download the file. type: String - contextPath: CarbonBlackEEDR.File.not_found description: The SHA256 hashes that were not found. type: String - contextPath: CarbonBlackEEDR.File.error description: The SHA256 hashes that had an intermittent error. type: String - arguments: - description: The requested SHA256 hash to obtain information for. Supports comma-separated values. name: sha256 required: true description: Return a summary of the observed file paths. name: cb-eedr-file-paths outputs: - contextPath: CarbonBlackEEDR.File.file_path_count description: The total number of unique file paths that have been observed, by this organization, for this file. type: Number - contextPath: CarbonBlackEEDR.File.file_paths description: The file path details. type: String - contextPath: CarbonBlackEEDR.File.sha256 description: The SHA256 hash of the file. type: Unknown - contextPath: CarbonBlackEEDR.File.total_file_path_count description: The total number of file paths that have been observed, by this organization, for this file. type: Number - arguments: - description: The process name to search. isArray: true name: process_name - description: The process hash to search. isArray: true name: process_hash - description: The event ID to search. name: event_id - description: The maximum number of rows to return. Default is 20. name: limit - description: A free-style query. For example, "process_name:svchost.exe". name: query - description: First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. name: start_time - description: Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. name: end_time - description: Index of first records to fetch. Default is 0. name: start - description: Job ID to retrieve. name: job_id hidden: true - description: whether to run the command with polling. name: polling defaultValue: true auto: PREDEFINED predefined: - 'true' - 'false' - description: The time in seconds to wait between polling. name: interval_in_seconds defaultValue: '60' - description: The timeout duration in seconds for polling retries. name: time_out defaultValue: 600 description: Creates a process search job and returns results if 'polling' argument is True. name: cb-eedr-process-search outputs: - contextPath: CarbonBlackEEDR.SearchProcess.job_id description: The ID of the job found by the search. type: String - contextPath: CarbonBlackEEDR.SearchProcess.status description: The status of the job found by the search. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.device_id description: The device ID that is guaranteed to be unique within each PSC environment. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username description: The user names related to the process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.backend_timestamp description: A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.childproc_count description: The cumulative count of child-process creations since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.crossproc_count description: The cumulative count of cross-process events since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_group_id description: The ID of the sensor group where the device belongs. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_name description: The name of the device. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.device_policy_id description: The ID of the policy applied to the device. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_timestamp description: The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched description: True if the process document came from the CBD data stream. type: Boolean - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched_event_type description: The CBD enriched event type. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.event_type description: 'The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL.' type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.filemod_count description: The cumulative count of file modifications since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.ingress_time description: Unknown. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.legacy description: True if the process document came from the legacy data stream (deprecated, use enriched). type: Boolean - contextPath: CarbonBlackEEDR.SearchProcess.results.modload_count description: The cumulative count of module loads since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.netconn_count description: The cumulative count of network connections since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.org_id description: The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_guid description: The process GUID of the parent process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_guid description: Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based). type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_hash description: The MD5 and SHA-256 hashes of the process's main module in a multi-valued field. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_name description: The tokenized file path of the process's main module. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_pid description: The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username description: User names related to the process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.regmod_count description: The cumulative count of registry modifications since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.scriptload_count description: The cumulative count of loaded scripts since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.job_id description: The ID of the job found by the search. type: String - contextPath: CarbonBlackEEDR.SearchProcess.status description: The status of the job found by the search. type: String polling: true - arguments: - description: The process GUID to search. Must be focused on a single process. name: process_guid - auto: PREDEFINED description: The event type to search. name: event_type predefined: - filemod - netconn - regmod - modload - crossproc - childproc - description: The maximum number of rows to return. Default is 20. name: limit - description: A free-style query. For example, "process_name:svchost.exe". name: query - description: First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. name: start_time - description: Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. name: end_time - description: Index of first records to fetch. Default is 0. name: start description: Retrieves the events associated with a given process. name: cb-eedr-events-by-process-get outputs: - contextPath: CarbonBlackEEDR.SearchEvent.backend_timestamp description: The timestamp of when the process was ingested by the backend. type: Date - contextPath: CarbonBlackEEDR.SearchEvent.created_timestamp description: The timestamp of when the event document was created. type: Date - contextPath: CarbonBlackEEDR.SearchEvent.event_guid description: A globally unique identifier for this event document. type: String - contextPath: CarbonBlackEEDR.SearchEvent.event_hash description: '' type: String - contextPath: CarbonBlackEEDR.SearchEvent.event_timestamp description: The timestamp of the event on the device. type: Date - contextPath: CarbonBlackEEDR.SearchEvent.event_type description: 'The event type. Possible values are: filemod, netconn, regmod, modload, crossproc, and childproc.' type: String - contextPath: CarbonBlackEEDR.SearchEvent.legacy description: True if this event comes from the CBD data stream. type: Boolean - contextPath: CarbonBlackEEDR.SearchEvent.modload_action description: 'Action associated with the modload operation. The only possible value is: ACTION_LOAD_MODULE.' type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_effective_reputation description: '' type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_md5 description: The MD5 hash for the modules loaded. type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_name description: The modules loaded by this event. type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_publisher description: The publisher that signed this module, if any. type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_publisher_state description: 'The set of states associated with the publisher of the module. Can be a combination of: FILE_SIGNATURE_STATE_INVALID, FILE_SIGNATURE_STATE_SIGNED, FILE_SIGNATURE_STATE_VERIFIED, FILE_SIGNATURE_STATE_NOT_SIGNED, FILE_SIGNATURE_STATE_UNKNOWN, FILE_SIGNATURE_STATE_CHAINED, FILE_SIGNATURE_STATE_TRUSTED, FILE_SIGNATURE_STATE_OS, and FILE_SIGNATURE_STATE_CATALOG_SIGNED.' type: String - contextPath: CarbonBlackEEDR.SearchEvent.modload_sha256 description: The SHA256 hash for the modules loaded. type: String - contextPath: CarbonBlackEEDR.SearchEvent.process_guid description: The process GUID representing the process that this event belongs to. type: String - contextPath: CarbonBlackEEDR.SearchEvent.process_pid description: The PID of the process. type: Number - arguments: - description: The job ID to search. isArray: true name: job_id required: true description: Retrieves the process search results for a given job ID. name: cb-eedr-process-search-results outputs: - contextPath: CarbonBlackEEDR.SearchProcess.job_id description: The ID of the job found by the search. type: String - contextPath: CarbonBlackEEDR.SearchProcess.status description: The status of the job found by the search. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.device_id description: The device ID that is guaranteed to be unique within each PSC environment. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username description: The user names related to the process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.backend_timestamp description: A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.childproc_count description: The cumulative count of child-process creations since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.crossproc_count description: The cumulative count of cross-process events since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_group_id description: The ID of the sensor group where the device belongs. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_name description: The name of the device. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.device_policy_id description: The ID of the policy applied to the device. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.device_timestamp description: The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched description: True if the process document came from the CBD data stream. type: Boolean - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched_event_type description: The CBD enriched event type. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.event_type description: 'The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL.' type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.filemod_count description: The cumulative count of file modifications since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.ingress_time description: Unknown. type: Date - contextPath: CarbonBlackEEDR.SearchProcess.results.legacy description: True if the process document came from the legacy data stream (deprecated, use enriched). type: Boolean - contextPath: CarbonBlackEEDR.SearchProcess.results.modload_count description: The cumulative count of module loads since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.netconn_count description: The cumulative count of network connections since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.org_id description: The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_guid description: The process GUID of the parent process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_pid description: The PID of the parent process. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_guid description: Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based). type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_hash description: The MD5 and SHA-256 hashes of the process’s main module in a multi-valued field. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_name description: The tokenized file path of the process’s main module. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.process_pid description: The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username description: User names related to the process. type: String - contextPath: CarbonBlackEEDR.SearchProcess.results.regmod_count description: The cumulative count of registry modifications since process tracking started. type: Number - contextPath: CarbonBlackEEDR.SearchProcess.results.scriptload_count description: The cumulative count of loaded scripts since process tracking started. type: Number - arguments: - description: Threat ID. name: threat_id required: true - description: Comma-separated list of tags. isArray: true name: tags required: true description: Update threat ID tags. name: cb-eedr-add-threat-tags outputs: - contextPath: CarbonBlackEEDR.Threat.ThreatID description: Threat ID. - contextPath: CarbonBlackEEDR.Threat.Tags description: Threat ID tags. - arguments: - description: Threat ID. name: threat_id required: true - description: Notes to be added to the provided threat ID. name: notes required: true description: Update threat ID notes. name: cb-eedr-add-threat-notes outputs: - contextPath: CarbonBlackEEDR.Threat.ThreatID description: Threat ID. - contextPath: CarbonBlackEEDR.Threat.Notes description: Threat ID notes. - arguments: - description: Alert ID to add the notes to. name: alert_id required: true - description: Notes to be added to the provided alert ID. name: notes required: true description: Update alert ID notes. name: cb-eedr-add-alert-notes outputs: - contextPath: CarbonBlackEEDR.Alert.AlertID description: The alert ID. - contextPath: CarbonBlackEEDR.Alert.Notes description: Alert notes. - arguments: - description: The threat ID for which we wish to get the tags. name: threat_id required: true description: Output a list of tags for the provided threat ID. name: cb-eedr-get-threat-tags outputs: - contextPath: CarbonBlackEEDR.Threat.ThreatID description: Threat ID. - contextPath: CarbonBlackEEDR.Threat.Tags description: Threat tags. dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '' subtype: python3 type: python tests: - Carbon Black Enterprise EDR Test - Carbon Black Enterprise EDR process search with polling Test - Carbon Black Enterprise EDR alert-workflow-update Test fromversion: 5.0.0