CarbonBlackLiveResponseCloud

VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.

Endpoint · Carbon Black Endpoint Standard

Configuration parameters

  • url — Server URL
  • custom_key — Custom Key
  • custom_id — Custom ID
  • credentials_custom_id — Custom ID
  • org_key — Organization Key
  • credentials_org_key —
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (14)

  • cbd-lr-directory-listing

    Lists the contents of a directory on the remote machine.

  • cbd-lr-execute

    Creates a new process on the remote machine with the specified command string.

  • cbd-lr-file-delete

    Deletes the specified file name on the remote machine.

  • cbd-lr-file-get

    Retrieves the contents of the specified file on the remote machine.

  • cbd-lr-file-put

    Creates a new file on the remote machine with the specified data.

  • cbd-lr-kill

    Terminates a process on the remote machine.

  • cbd-lr-memdump

    Performs a memory dump operation on the remote machine.

  • cbd-lr-ps

    Lists the currently running processes on the remote machine.

  • cbd-lr-reg-get-values

    Enumerates all registry values from the specified registry key on the remote machine. Due to API limitations, binary values will not be shown.

  • cbd-lr-reg-key-create

    Creates a new registry key on the remote machine.

  • cbd-lr-reg-key-delete

    Deletes a registry key on the remote machine. The key must be without any subkeys.

  • cbd-lr-reg-sub-keys

    Enumerates the subkeys of the specified registry key on the remote machine.

  • cbd-lr-reg-value-delete

    Deletes a registry value on the remote machine.

  • cbd-lr-reg-value-set

    Sets a registry value on the specified registry key on the remote machine.