CarbonBlackProtectionV2

category: Endpoint
provider: Broadcom
sectionorder:
- Connect
- Collect
commonfields:
  id: CarbonBlackProtectionV2
  version: -1
configuration:
- defaultvalue: https://192.168.0.1
  display: Server URL (e.g. https://192.168.0.1)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Token
  name: api_token
  type: 9
  hiddenusername: true
  section: Connect
  display: ''
  required: false
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- defaultvalue: '15'
  display: Max incidents per fetch
  name: incidents_per_fetch
  type: 0
  section: Collect
  required: false
- display: Fetch query
  name: fetch_query
  type: 0
  section: Collect
  advanced: true
  required: false
- display: API Token
  name: token
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
description: VMware Carbon Black App Control (formerly known as Carbon Black Enterprise Protection) is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform. This integration only supports Carbon Black on-premise APIs.
display: VMware Carbon Black App Control v2
name: CarbonBlackProtectionV2
script:
  commands:
  - arguments:
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field. Example: group=osShortName.'
      name: group
    - description: '(Int) Is maximum number of results to retrieve. If not specified: First 1000 results will be returned. If set to -1: Only result count will be returned, without actual results. Offset parameter is ignored in this case. If set to 0: All results will be returned. Offset parameter is ignored in this case. Note that some result sets could be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.'
      name: limit
    - description: (Int) Offset in data set.
      name: offset
    - description: 'A condition contains three parts: name, operator, and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. See more: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: 'Sorting is optional and can be defined with a single attribute: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order (if omitted) is ASC. xyz is field name from the result set.'
      name: sort
    - description: Name of the file under which this unique hash was first seen.
      name: fileName
    - description: Type of the file.
      name: fileType
    - description: Id of computer where this file was first seen. You can get this by executing cbp-computer-search command.
      name: computerId
    - auto: PREDEFINED
      description: |-
        Threat of this file. Can be one of:
        -1=Unknown
        0=Clean
        50=Potential risk
        100=Malicious.
      name: threat
      predefined:
      - Unknown
      - Clean
      - Potential risk
      - Malicious
    - auto: PREDEFINED
      description: |-
        File state of this hash. Can be one of:
        1=Unapproved
        2=Approved
        3=Banned
        4=Approved by Policy
        5=Banned by Policy.
      name: fileState
      predefined:
      - Unapproved
      - Approved
      - Banned
      - Approved by Policy
      - Banned by Polic
    - description: Hash of the file.
      name: hash
    description: 'Search for file catalogs. See more: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filecatalog'
    name: cbp-fileCatalog-search
    outputs:
    - contextPath: File.Size
      description: Size of the file.
      type: Unknown
    - contextPath: File.Path
      description: Path on the found hostname.
      type: String
    - contextPath: File.Name
      description: Name of the file.
      type: String
    - contextPath: File.Type
      description: File type.
      type: String
    - contextPath: File.ProductName
      description: The name of the product to which this file belongs.
      type: String
    - contextPath: File.ID
      description: Unique fileCatalog ID.
      type: String
    - contextPath: File.Publisher
      description: The publisher of the file.
      type: String
    - contextPath: File.Company
      description: The company for the product.
      type: String
    - contextPath: File.Extension
      description: Extension of the file.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator, and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with an operator and depends on field type. See more: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Offset in data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order (if omitted) is ascending (ASC). xyz is field name from the result set.'
      name: sort
    - description: Maximum number of results to retrieve (Int). If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the Offset parameter is ignored. If set to "0", all results will be returned, and the Offset parameter is ignored. Some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: Computer name.
      name: name
    - description: Last known IP address of this computer.
      name: ipAddress
    - description: MAC address of adapter used to connect to the CB Protection Server.
      name: macAddress
    - description: CSV list of fields to limit the fields returned from the console.
      name: fields
    description: 'Search for computers. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#computer'
    name: cbp-computer-search
    outputs:
    - contextPath: Endpoint.OS
      description: The short OS name running on the endpoint.
      type: String
    - contextPath: Memory
      description: Amount of memory for the endpoint.
      type: Number
  - arguments:
    - default: true
      description: (Int) Unique computer ID.
      name: id
      required: true
    - description: (String) Computer name can be changed only if computer is a template.
      name: name
    - description: (String) Custom computer tag.
      name: computerTag
    - description: (String) Description of this computer.
      name: description
    - description: (Int) New ID of the policy for this computer. PolicyId is ignored if either automaticPolicy is "True" or localApproval is "True".
      name: policyId
    - auto: PREDEFINED
      description: (Boolean) "True" if this policy is assigned automatically through AD. If localApproval is "True", this argument must be "False".
      name: automaticPolicy
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: (Boolean) "True" if this computer is currently in local approval mode. If automaticPolicy is "True", this argument must be "False".
      name: localApproval
      predefined:
      - 'True'
      - 'False'
    - description: '(Int) Change refresh flags for this agent. Can be a combination of: 0x01=Complete resynch of agent NAB and installer table is requested 0x02=Rescan of programs installed on the computer is requested 0x20=Tell agent to refresh config list 0x40=Force this agent to reregister with new cookie 0x200=Trigger agent Reboot. 0x1000=Tell agent to refresh config list from the file 0x4000 Boost the priority of this agent over all others permanently (until it is de-prioritized).'
      name: refreshFlags
    - auto: PREDEFINED
      description: (Boolean) Set to "True" to prioritize this computer.
      name: prioritized
      predefined:
      - 'True'
      - 'False'
    - description: (Int) Current debug level of the agent. Range is from 0 (none) to 8 (verbose). This value can be changed only if the "changeDiagnostics" request parameter is set to "True".
      name: debugLevel
    - description: (Int) Current kernel debug level of the agent. Range is from 0 (none) to 5 (verbose). This value can be changed only if the "changeDiagnostics" request parameter is set to "True".
      name: kernelDebugLevel
    - description: '(Int) Debug flags. Can be 0 or combination of: 0x01 = Upload debug files now 0x10 = Enable full memory dumps 0x20 = Copy agent cache 0x40 = Delete debug files 0x80 = Upload agent cache 0x200 = Save verbose debug info + counters to the cache when copied/uploaded 0x400 = Generate and upload an analysis.bt9 file that contains various constraint violation analysis information 0x800 = Run a health check and send results to server. This value can be changed only if the "changeDiagnostics" request parameter is set to "True".'
      name: debugFlags
    - description: (Int) Debug duration in minutes. This value can be changed only if the "changeDiagnostics" request parameter is set to "True".
      name: debugDuration
    - description: '(Int) Cache consistency check level set for the agent. Can be one of: 0 = None 1 = Quick verification 2 = Rescan known files Full scan for new files. This value can be changed only if the "changeDiagnostics" request parameter is set to "True".'
      name: cCLevel
    - description: '(Int) Cache consistency check flags set for agent. Can be 0 or combination of: 0x0001 = Whether this is just a test run or not 0x0002 = Should the state of invalid files be preserved 0x0004 = Should new files found be locally approved or not 0x0008 = Should we re-evaluate whether a file’s certificate information is still valid or not 0x0010 = Whether the check was scheduled or not 0x0020 = Whether the agent should run constraint checks to test for invalid results 0x0040 = Whether we are only searching for new script types as a result of a change to what ‘IsScript’ means 0x0080 = Whether we are doing a level 3 check for initialization 0x0100 = This cache check is to remediate CR# 18041 0x0200 = Force the re-evaluation of the IsCrawlable state and archive type.'
      name: cCFlags
    - auto: PREDEFINED
      description: (Boolean) Set to "True" to force an upgrade for this computer.
      name: forceUpgrade
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: (Boolean) "True" if the computer is a VDI template. This value can be changed only if the "changeTemplate" request parameter is set to "True".
      name: template
      predefined:
      - 'True'
      - 'False'
    description: 'Updates computer objects. Note that some computer properties can be changed only if specific boolean parameters are set. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#computer'
    name: cbp-computer-update
    outputs:
    - contextPath: Endpoint.Processors
      description: The number of processors.
      type: Number
    - contextPath: Endpoint.OS
      description: The short OS name running on the endpoint.
      type: String
    - contextPath: Endpoint.MACAddress
      description: MAC address of the endpoint.
      type: String
    - contextPath: Endpoint.Model
      description: The machine model, if available.
      type: String
    - contextPath: Endpoint.IPAddress
      description: IP address of the endpoint.
      type: String
    - contextPath: Endpoint.Processor
      description: Model of the processor.
      type: String
    - contextPath: Endpoint.Hostname
      description: Hostname of the endpoint.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The full OS name running on the endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retreiving the endpoint.
      type: String
  - arguments:
    - default: true
      description: (Int) Unique computer ID.
      name: id
      required: true
    description: 'Returns information for a computer. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#computer'
    name: cbp-computer-get
    outputs:
    - contextPath: Endpoint.Processors
      description: The number of processors.
      type: Number
    - contextPath: Endpoint.OS
      description: The short OS name running on the endpoint.
      type: String
    - contextPath: Endpoint.MACAddress
      description: MAC address of the endpoint.
      type: String
    - contextPath: Endpoint.Model
      description: The machine model, if available.
      type: String
    - contextPath: Endpoint.IPAddress
      description: IP address of the endpoint.
      type: String
    - contextPath: Endpoint.Processor
      description: Model of the processor.
      type: String
    - contextPath: Endpoint.Hostname
      description: Hostname of the endpoint.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The full OS name running on the endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retreiving the endpoint.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute, where xyz is the field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - description: Id of computer associated with this fileInstance.
      name: computerId
    - description: Name of the file on the agent.
      name: fileName
    description: 'Search for file instances. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#fileinstance'
    name: cbp-fileInstance-search
    outputs:
    - contextPath: CBP.FileInstance.CatalogID
      description: The file ID in the file catalog.
      type: String
    - contextPath: CBP.FileInstance.ComputerID
      description: The computer ID on which the file was found.
      type: String
    - contextPath: CBP.FileInstance.ID
      description: CBP internal ID of the file instance.
      type: String
    - contextPath: CBP.FileInstance.Name
      description: Name of the file.
      type: String
    - contextPath: CBP.FileInstance.Path
      description: Path on the found hostname.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute, where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - auto: PREDEFINED
      description: |-
        Event type. Can be one of:
        0 = Server Management
        1 = Session Management
        2 = Computer Management
        3 = Policy Management
        4 = Policy Enforcement
        5 = Discovery
        6 = General Management
        8 = Internal Events.
      name: type
      predefined:
      - Server Management
      - Session Management
      - Computer Management
      - Policy Management
      - Policy Enforcement
      - Discovery
      - General Management
      - Internal Events
    - description: Id of computer associated with this event. You can get this by executing cbp-computer-search command.
      name: computerId
    - description: IP address associated with this event.
      name: ipAddress
    - description: Name of the file associated with this event.
      name: fileName
    - auto: PREDEFINED
      description: |-
        Event severity. Can be one of:
        2 = Critical
        3 = Error
        4 = Warning
        5 = Notice
        6 = Info
        7 = Debug.
      name: severity
      predefined:
      - Critical
      - Error
      - Warning
      - Notice
      - Info
      - Debug
    - description: User name associated with this event.
      name: userName
    - description: Id of fileCatalog entry associated with this fileRule. Can be null if file hasn’t been seen on any endpoints yet. You can get this by executing cbp-fileCatalog-search.
      name: fileCatalogId
    description: 'Search for events. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#event'
    name: cbp-event-search
    outputs:
    - contextPath: CBP.Event.FilePath
      description: File path of the event.
      type: String
    - contextPath: CBP.Event.Param1
      description: First event parameter.
      type: String
    - contextPath: CBP.Event.Param2
      description: Second event parameter.
      type: String
    - contextPath: CBP.Event.Param3
      description: Third event parameter.
      type: String
    - contextPath: CBP.Event.SubTypeName
      description: Name of the subtype.
      type: String
    - contextPath: CBP.Event.ComputerName
      description: Name of the computer related to the event.
      type: String
    - contextPath: CBP.Event.FileName
      description: Name of the file related to the event.
      type: String
    - contextPath: CBP.Event.RuleName
      description: Name of the rule related to the event.
      type: String
    - contextPath: CBP.Event.ProcessFileCatalogID
      description: ID of the process file catalog ID.
      type: String
    - contextPath: CBP.Event.StringID
      description: ID of the event string.
      type: String
    - contextPath: CBP.Event.IPAddress
      description: IP address of the event.
      type: String
    - contextPath: CBP.Event.PolicyID
      description: Policy ID of the event.
      type: String
    - contextPath: CBP.Event.Timestamp
      description: Timestamp of the event.
      type: Date
    - contextPath: CBP.Event.Username
      description: Username related to the event.
      type: String
    - contextPath: CBP.Event.ComputerID
      description: ID of the event computer.
      type: String
    - contextPath: CBP.Event.ProcessFileName
      description: File name of the process.
      type: String
    - contextPath: CBP.Event.FileCatalogID
      description: ID of the file catalog.
      type: String
    - contextPath: CBP.Event.ProcessFileName
      description: File name of the process.
      type: String
    - contextPath: CBP.Event.IndicatorName
      description: Indicator name of the event.
      type: String
    - contextPath: CBP.Event.SubType
      description: ID of the subtype.
      type: Number
    - contextPath: CBP.Event.Type
      description: Type of the event.
      type: Number
    - contextPath: CBP.Event.ID
      description: ID of the event.
      type: Number
    - contextPath: CBP.Event.Description
      description: Description of the event.
      type: String
    - contextPath: CBP.Event.Severity
      description: Severity of the event.
      type: String
    - contextPath: CBP.Event.CommandLine
      description: Command line executed in the event.
      type: String
    - contextPath: CBP.Event.ProcessPathName
      description: Path name of the process.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field. Example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute, where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    description: 'Search for approval requests. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#approvalrequest'
    name: cbp-approvalRequest-search
    outputs:
    - contextPath: CBP.ApprovalRequest.ID
      description: ID of the approval request.
      type: Number
    - contextPath: CBP.ApprovalRequest.ResolutionComments
      description: Comments added by the request resolver.
      type: String
    - contextPath: CBP.ApprovalRequest.Resolution
      description: 'Resolution of the request. Can be one of: 0=Not Resolved, 1=Rejected, 2=Resolved - Approved, 3=Resolved - Rule Change, 4=Resolved - Installer, 5=Resolved - Updater, 6=Resolved - Publisher, 7=Resolved - Other.'
      type: Number
    - contextPath: CBP.ApprovalRequest.Status
      description: 'Request status. Can be one of: 1=New, 2=Open, 3=Closed, 4=Escalated.'
      type: Number
    - contextPath: CBP.ApprovalRequest.FileCatalogID
      description: ID of the fileCatalog entry associated with file for this event.
      type: Number
    - contextPath: CBP.ApprovalRequest.ComputerID
      description: ID of the computer entry associated with this analysis.
      type: Number
    - contextPath: CBP.ApprovalRequest.ComputerName
      description: Name of the computer associated with this event.
      type: String
    - contextPath: CBP.ApprovalRequest.DateCreated
      description: Date/time when the notifier was created (UTC).
      type: Date
    - contextPath: CBP.ApprovalRequest.CreatedBy
      description: User that created this notifier.
      type: String
    - contextPath: CBP.ApprovalRequest.EnforcementLevel
      description: 'Enforcement level of the agent at the time of the request. Can be one of: 20=High (Block Unapproved), 30=Medium (Prompt Unapproved), 40=Low (Monitor Unapproved), 60=None (Visibility), 80=None (Disabled).'
      type: Number
    - contextPath: CBP.ApprovalRequest.RequestorEmail
      description: Email address of the user that created this request.
      type: String
    - contextPath: CBP.ApprovalRequest.Priority
      description: 'Priority of this request. Can be one of: 0=High, 1=Medium, 2=Low.'
      type: Number
    - contextPath: CBP.ApprovalRequest.FileName
      description: Name of the file on the agent.
      type: String
    - contextPath: CBP.ApprovalRequest.PathName
      description: Path of the file on the agent.
      type: String
    - contextPath: CBP.ApprovalRequest.Process
      description: Process that attempted to execute the file on the agent (the full process path).
      type: String
    - contextPath: CBP.ApprovalRequest.Platform
      description: Platform of this approval request.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the offset parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - description: Id of fileCatalog entry associated with this fileRule. Can be null if file hasn’t been seen on any endpoints yet. You can get this by executing cbp-fileCatalog-search.
      name: fileCatalogId
    - description: Name of this rule.
      name: name
    - auto: PREDEFINED
      description: |-
        File state for this rule. Can be one of:
        1=Unapproved
        2=Approved
        3=Banned.
      name: fileState
      predefined:
      - Unapproved
      - Approved
      - Banned
    - auto: PREDEFINED
      description: "Mechanism that created this rule. Can be one of: \n1 = Manual\n2 = Trusted Directory\n3 = Reputation\n4 = Imported\n5 = External (API)\n6 = Event Rule\n7 = Application Template\n8 = Unified Management."
      name: sourceType
      predefined:
      - Manual
      - Trusted Directory
      - Reputation
      - Imported
      - External (API)
      - Event Rule
      - Application Template
      - Unified Management
    - description: Hash associated with this rule. Note that hash will be available only if rule was created through md5 or sha-1 hash. If rule was created through fileCatalogId or sha-256 hash that exists in the catalog, this field will be empty.
      name: hash
    - description: File name associated with this rule. Note that file name will be available only if rule was created through file name. If rule was created through fileCatalogId or hash, this field will be empty.
      name: fileName
    description: 'Search for file rules. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filerule'
    name: cbp-fileRule-search
    outputs:
    - contextPath: CBP.FileRule.CatalogID
      description: The file catalog ID for the rule.
      type: String
    - contextPath: CBP.FileRule.Description
      description: Description of the rule.
      type: String
    - contextPath: CBP.FileRule.FileState
      description: The file state for the rule.
      type: String
    - contextPath: CBP.FileRule.Hash
      description: Hash for the rule.
      type: String
    - contextPath: CBP.FileRule.ID
      description: ID of the rule.
      type: String
    - contextPath: CBP.FileRule.Name
      description: Name of the rule.
      type: String
    - contextPath: CBP.FileRule.PolicyIDs
      description: Policies of which this rule is a part.
      type: String
    - contextPath: CBP.FileRule.ReportOnly
      description: Whether this rule is "reporting only, or also "enforcing".
      type: String
  - arguments:
    - default: true
      description: (Int) Unique ID of the file rule.
      name: id
      required: true
    description: 'Gets the file rule. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filerule'
    name: cbp-fileRule-get
    outputs:
    - contextPath: CBP.FileRule.CatalogID
      description: The file catalog ID for the rule.
      type: String
    - contextPath: CBP.FileRule.Description
      description: Description of the rule.
      type: String
    - contextPath: CBP.FileRule.FileState
      description: The file state for the rule.
      type: String
    - contextPath: CBP.FileRule.Hash
      description: Hash for the rule.
      type: String
    - contextPath: CBP.FileRule.ID
      description: ID of the rule.
      type: String
    - contextPath: CBP.FileRule.Name
      description: Name of the rule.
      type: String
    - contextPath: CBP.FileRule.PolicyIDs
      description: Policies of which this rule is a part.
      type: String
    - contextPath: CBP.FileRule.ReportOnly
      description: Whether this rule is "reporting only, or also "enforcing".
      type: String
  - arguments:
    - default: true
      description: (Int) Unique id of this fileRule.
      name: id
      required: true
    description: 'Deletes the file rule. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filerule'
    name: cbp-fileRule-delete
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - auto: PREDEFINED
      description: |-
        Target enforcement level. Can be one of:
        20=High (Block Unapproved)
        30=Medium (Prompt Unapproved)
        40=Low (Monitor Unapproved)
        60=None (Visibility)
        80=None (Disabled).
      name: enforcementLevel
      predefined:
      - High (Block Unapproved)
      - Medium (Prompt Unapproved)
      - Low (Monitor Unapproved)
      - None (Visibility)
      - None (Disabled)
    - auto: PREDEFINED
      description: |-
        Target enforcement level for disconnected computers. Can be one of:
        20=High (Block Unapproved)
        30=Medium (Prompt Unapproved)
        40=Low (Monitor Unapproved)
        60=None (Visibility)
        80=None (Disabled).
      name: disconnectedEnforcementLevel
      predefined:
      - High (Block Unapproved)
      - Medium (Prompt Unapproved)
      - Low (Monitor Unapproved)
      - None (Visibility)
      - None (Disabled)
    description: 'Search for policies. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#policy'
    name: cbp-policy-search
    outputs:
    - contextPath: CBP.Policy.ReadOnly
      description: Whether the policy "read-only".
      type: Boolean
    - contextPath: CBP.Policy.EnforcementLevel
      description: The level of enforcement of the policy.
      type: String
    - contextPath: CBP.Policy.ReputationEnabled
      description: Whether the reputation for the policy is enabled.
      type: Boolean
    - contextPath: CBP.Policy.AtEnforcementComputers
      description: Number of enforced computers.
      type: Number
    - contextPath: CBP.Policy.Automatic
      description: Whether the policy is automatic.
      type: Boolean
    - contextPath: CBP.Policy.Name
      description: Name of the policy.
      type: String
    - contextPath: CBP.Policy.FileTrackingEnabled
      description: Whether file tracking enabled for the policy.
      type: Boolean
    - contextPath: CBP.Policy.ConnectedComputers
      description: Number of connected computers associated with the policy.
      type: Number
    - contextPath: CBP.Policy.PackageName
      description: Package name of the policy.
      type: String
    - contextPath: CBP.Policy.AllowAgentUpgrades
      description: Whether the policy allows agent upgrades.
      type: Boolean
    - contextPath: CBP.Policy.TotalComputers
      description: Number of computers associated with the policy.
      type: Number
    - contextPath: CBP.Policy.LoadAgentInSafeMode
      description: Whether the agent should load in safe mode.
      type: Boolean
    - contextPath: CBP.Policy.AutomaticApprovalsOnTransition
      description: Approve on transition.
      type: String
    - contextPath: CBP.Policy.ID
      description: CBP internal ID of the policy.
      type: String
    - contextPath: CBP.Policy.Description
      description: Description of the policy.
      type: String
    - contextPath: CBP.Policy.DisconnectedEnforcementLevel
      description: The level of enforcement of the policy when disconnected.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching.'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    description: 'Search in server configurations. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#serverconfig.'
    name: cbp-serverConfig-search
    outputs:
    - contextPath: CBP.ServerConfig.ID
      description: CBP internal ID of the server configuration.
      type: String
    - contextPath: CBP.ServerConfig.Name
      description: Name of the server configuration.
      type: String
    - contextPath: CBP.ServerConfig.Value
      description: Value of the server configuration.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching.'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the "offset" parameter is ignored. If set to "0", all results will be returned, and the "offset" parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute where xyz is field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - description: Subject name of leaf certificate for this publisher.
      name: name
    - auto: PREDEFINED
      description: |-
        Reputation of this publisher. Can be one of:
        0=Not trusted (Unknown)
        1=Low
        2=Medium
        3=High.
      name: publisherReputation
      predefined:
      - Not trusted (Unknown)
      - Low
      - Medium
      - High
    - auto: PREDEFINED
      description: |-
        State for this publisher. Can be one of:
        1=Unapproved
        2=Approved
        3=Banned
        4=Approved By Policy
        5=Banned By Policy.
      name: publisherState
      predefined:
      - Unapproved
      - Approved
      - Banned
      - Approved By Policy
      - Banned By Policy
    description: 'Search for publishers. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#publisher.'
    name: cbp-publisher-search
    outputs:
    - contextPath: CBP.Publisher.Description
      description: Description of the publisher.
      type: String
    - contextPath: CBP.Publisher.ID
      description: CBP internal ID of the publisher.
      type: String
    - contextPath: CBP.Publisher.Name
      description: Name of the publisher.
      type: String
    - contextPath: CBP.Publisher.Reputation
      description: Reputation of the publisher.
      type: String
    - contextPath: CBP.Publisher.SignedCertificatesCount
      description: Number of certificates from the publisher.
      type: Number
    - contextPath: CBP.Publisher.SignedFilesCount
      description: Number of signed files from publisher.
      type: Number
    - contextPath: CBP.Publisher.State
      description: The state of the publisher.
      type: String
  - arguments:
    - default: true
      description: (Int) Unique fileAnalysis ID.
      name: id
      required: true
    description: Returns the object instance of this class.
    name: cbp-fileAnalysis-get
    outputs:
    - contextPath: CBP.FileAnalysis.Priority
      description: File analysis priority.  Valid range is [-2, 2], where 2 is highest priority. Default priority is "0".
      type: Number
    - contextPath: CBP.FileAnalysis.PathName
      description: Path of the file on the endpoint.
      type: String
    - contextPath: CBP.FileAnalysis.ComputerId
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileAnalysis.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.CreatedBy
      description: User that requested the analysis.
      type: String
    - contextPath: File.FileCatalogId
      description: ID ofthe fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.FileName
      description: Name of the file on the endpoint.
      type: String
    - contextPath: File.Malicious
      description: Vendor and description of the malicious file.
      type: String
    - contextPath: File.PathName
      description: Path of the file on the endpoint.
      type: Unknown
    - contextPath: File.Name
      description: ' Full file name, for example: "data.xls". '
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The DBot score vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The DBot score.
      type: number
  - arguments:
    - description: (Int) ID of the fileCatalog entry for which analysis is requested. This value can be fetched via cbp-fileCatalog-search command.
      name: fileCatalogId
      required: true
    - description: (Int) ID of the target connector for the analysis. This value can be fetched via cbp-connector-search command.
      name: connectorId
      required: true
    - defaultValue: '0'
      description: (Int) ID of the computer from which to upload the file. If "0", the system will identify the best computer from which to get the file. This value can be fetched via cbp-computer-search command.
      name: computerId
    - defaultValue: '0'
      description: '(Int) The analysis priority (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      name: priority
      predefined:
      - '-2'
      - '-1'
      - '0'
      - '1'
      - '2'
      auto: PREDEFINED
    - description: (Int) Status of the analysis. The status of an analysis that is in progress can be changed to "5" (Cancelled).
      name: analysisStatus
    - description: (String) Target of the analysis. It has to be one of possible analysisTarget options defined for the given connector object, or empty for connectors without defined analysisTargets.
      name: analysisTarget
    - description: If specified, will try to update the file analysis with this ID.
      name: id
    description: Creates or updates a file analysis request.
    name: cbp-fileAnalysis-createOrUpdate
    outputs:
    - contextPath: CBP.FileAnalysis.Priority
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      type: Number
    - contextPath: CBP.FileAnalysis.PathName
      description: Path of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileAnalysis.ComputerID
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileAnalysis.CreatedBy
      description: User that requested the analysis.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more informatoin, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the offset parameter is ignored. If set to "0", all results will be returned, and the offset parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute: &sort=xyz [ASC|DESC], where xyz is the field name from the result set. There can be only one sorting field. Default sort order is ascending (ASC). '
      name: sort
    - description: Id of fileCatalog entry associated with this analysis. You can get this by executing cbp-fileCatalog-search.
      name: fileCatalogId
    - description: Id of connector associated with this analysis. You can get this by executing cbp-connector-search.
      name: connectorId
    - description: |-
        Name of the file where file exists on the endpoint.
      name: fileName
    - auto: PREDEFINED
      description: |-
        Status of analysis. Can be one of:
        0 = scheduled
        1 = submitted (file is sent for analysis)
        2 = processed (file is processed but results are not available yet)
        3 = analyzed (file is processed and results are available)
        4 = error
        5 = cancelled.
      name: analysisStatus
      predefined:
      - scheduled
      - submitted (file is sent for analysis)
      - processed (file is processed but results are not available yet)
      - analyzed (file is processed and results are available)
      - error
      - cancelled
    - auto: PREDEFINED
      description: |-
        Result of the analysis. Can be one of:
        0 = Not yet available
        1 = File is clean
        2 = File is a potential threat
        3 = File is malicious.
      name: analysisResult
      predefined:
      - Not yet available
      - File is clean
      - File is a potential threat
      - File is malicious
    description: Returns objects that match the specified criteria.
    name: cbp-fileAnalysis-search
    outputs:
    - contextPath: CBP.FileAnalysis.Priority
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      type: Number
    - contextPath: CBP.FileAnalysis.PathName
      description: Path of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileAnalysis.ComputerID
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileAnalysis.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileAnalysis.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileAnalysis.CreatedBy
      description: User that requested this analysis.
      type: String
  - arguments:
    - default: true
      description: (Int) Unique ID of this fileUpload.
      name: id
      required: true
    description: Returns the object instance of this class.
    name: cbp-fileUpload-get
    outputs:
    - contextPath: CBP.FileUpload.Priority
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      type: Number
    - contextPath: CBP.FileUpload.FileName
      description: Name of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.UploadPath
      description: Local upload path for the file on the server (can be a shared network path). Note that the file is compressed in a ZIP archive.
      type: String
    - contextPath: CBP.FileUpload.ComputerId
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileUpload.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileUpload.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileUpload.PathName
      description: Path of the file where there file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.UploadStatus
      description: 'Status of the upload (valid range: 0-6).'
      type: Number
    - contextPath: CBP.FileUpload.UploadedFileSize
      description: Size of the uploaded file. The file size will be 0 unless the uploadStatus is "3" (Completed).
      type: String
    - contextPath: CBP.FileUpload.CreatedBy
      description: User that requested the analysis.
      type: String
  - arguments:
    - default: true
      description: (Int) Unique ID of the fileUpload.
      name: id
      required: true
    description: Returns the bject instance of this class.
    name: cbp-fileUpload-download
  - arguments:
    - description: (Int) ID of the fileCatalog entry for file to upload. This value can be fetched via cbp-fileCatalog-search command.
      name: fileCatalogId
      required: true
    - defaultValue: '0'
      description: (Int) ID of the computer entry associated with this analysis. This value can be fetched via cbp-computer-search command.
      name: computerId
    - auto: PREDEFINED
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      name: priority
      predefined:
      - '-2'
      - '-1'
      - '0'
      - '1'
      - '2'
    - description: (Int)Status of upload. The status of "upload in progress" can be changed to "5" (Cancelled). Any upload can be changed to "6" (Deleted).
      name: uploadStatus
    - description: ID of the file upload to update. If omitted, will create a new file upload.
      name: id
    description: Creates or updates a file upload request.
    name: cbp-fileUpload-createOrUpdate
    outputs:
    - contextPath: CBP.FileUpload.Priority
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      type: Number
    - contextPath: CBP.FileUpload.CreatedByUserId
      description: ID of the user that requested the analysis.
      type: String
    - contextPath: CBP.FileUpload.UploadPath
      description: Local upload path for this file on the server (can be a shared network path). Note that the file is compressed in a ZIP archive.
      type: String
    - contextPath: CBP.FileUpload.FileName
      description: Name of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.PathName
      description: Path of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.UploadStatus
      description: 'Status of the upload (valid range: 0-6).'
      type: Number
    - contextPath: CBP.FileUpload.ComputerID
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileUpload.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileUpload.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileUpload.UploadedFileSize
      description: Size of uploaded file. The file size will be 0 unless the uploadStatus is "3" (Completed).
      type: Number
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the offset parameter is ignored. If set to "0", all results will be returned, and the offset parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute: &sort=xyz [ASC|DESC], where xyz is the field name from the result set. There can be only one sorting field. Default sort order is ascending (ASC).'
      name: sort
    - description: Id of computer entry associated with this analysis. This can be fetched via cbp-computer-search.
      name: computerId
    - description: Id of fileCatalog entry associated with this upload. This can be fetched via cbp-fileCatalog-search.
      name: fileCatalogId
    - description: Name of the file where file exists on the endpoint.
      name: fileName
    - auto: PREDEFINED
      description: |-
        Status of upload. Can be one of:
        0 = Queued
        1 = Initiated
        2 = Uploading
        3 = Completed
        4 = Error
        5 = Cancelled
        6 = Deleted.
      name: uploadStatus
      predefined:
      - Queued
      - Initiated
      - Uploading
      - Completed
      - Error
      - Cancelled
      - Deleted
    description: Returns objects that match the specified criteria.
    name: cbp-fileUpload-search
    outputs:
    - contextPath: CBP.FileUpload.Priority
      description: 'File analysis priority in range (valid range: -2, 2), where "2" is highest priority. Default priority is "0".'
      type: Number
    - contextPath: CBP.FileUpload.CreatedByUserId
      description: ID of the user that requested the analysis.
      type: String
    - contextPath: CBP.FileUpload.UploadPath
      description: Local upload path for this file on the server (can be a shared network path). Note that the file is compressed in a ZIP archive.
      type: String
    - contextPath: CBP.FileUpload.FileName
      description: Name of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.PathName
      description: Path of the file where the file exists on the endpoint.
      type: String
    - contextPath: CBP.FileUpload.UploadStatus
      description: 'Status of upload (valid range: 0-6).'
      type: Number
    - contextPath: CBP.FileUpload.ComputerID
      description: ID of the computer entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateModified
      description: Date/time when the fileAnalysis request was last modified (UTC).
      type: Date
    - contextPath: CBP.FileUpload.FileCatalogId
      description: ID of the fileCatalog entry associated with this analysis.
      type: String
    - contextPath: CBP.FileUpload.DateCreated
      description: Date/time when the fileAnalysis request was created (UTC).
      type: Date
    - contextPath: CBP.FileUpload.ID
      description: Unique fileAnalysis ID.
      type: String
    - contextPath: CBP.FileUpload.UploadedFileSize
      description: Size of the uploaded file. The file size will be 0 unless the uploadStatus is "3" (Completed).
      type: Number
  - arguments:
    - default: true
      description: (Int) Unique connector ID.
      name: id
      required: true
    description: Returns the object instance of this class.
    name: cbp-connector-get
    outputs:
    - contextPath: CBP.Connector.AnalysisEnabled
      description: '"True" if the analysis component of this connector is enabled. "False" if the analysis component of this connector is disabled.'
      type: Boolean
    - contextPath: CBP.Connector.AnalysisName
      description: Name for the analysis component of the connector (can be same as the name field).
      type: String
    - contextPath: CBP.Connector.AnalysisTargets
      description: Array of possible analysis targets. Analysis targets are required when creating a new fileAnalysis. They usualy represent different OS and configurations and are available only for some internal connectors.
      type: String
    - contextPath: CBP.Connector.CanAnalyze
      description: '"True" if this connector can analyze files. "False" if this connector cannot analyze files.'
      type: Boolean
    - contextPath: CBP.Connector.ConnectorVersion
      description: Version of this connector.
      type: String
    - contextPath: CBP.Connector.Enabled
      description: '"True" if the connector is enabled. "False" if the connector is disabled.'
      type: Boolean
    - contextPath: CBP.Connector.ID
      description: Unique fileAnalysis ID.
      type: String
  - arguments:
    - description: 'A condition contains three parts: name, operator and value. Name is any valid field in the object that is being queried. Operator (: LIKE, ! NOT LIKE, < Less than, > Greater than, + logical AND, - logical OR, | separating values) is any of valid operators (see below). All operators consist of a single character. Value is compared with operator and depends on field type. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#searching.'
      name: query
    - description: (Int) Maximum number of results to retrieve. If not specified, the first 1000 results will be returned. If set to "-1", only the result count will be returned, without actual results, and the offset parameter is ignored. If set to "0", all results will be returned, and the offset parameter is ignored. Note that some result sets might be very large, resulting in query timeout. Therefore, unless you know that query will not return more than 1000 results, it is recommended to retrieve data in chunks using offset and limit.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - description: 'Grouping is optional and can be defined with a single attribute: &group=xyz. There can be only one grouping field, for example: group=osShortName.'
      name: group
    - description: 'Sorting is optional and can be defined with a single attribute where xyz is the field name from the result set: &sort=xyz [ASC|DESC]. There can be only one sorting field. Default sort order is ascending (ASC).'
      name: sort
    description: Returns objects that match the specified criteria.
    name: cbp-connector-search
    outputs:
    - contextPath: CBP.Connector.AnalysisEnabled
      description: '"True" if the analysis component of this connector is enabled. "False" if the analysis component of this connector is disabled.'
      type: Boolean
    - contextPath: CBP.Connector.AnalysisName
      description: Name for the analysis component of the connector (can be same as the name field).
      type: String
    - contextPath: CBP.Connector.AnalysisTargets
      description: Array of possible analysis targets. Analysis targets are required when creating a new fileAnalysis. They usualy represent different OS and configurations and are available only for some internal connectors.
      type: String
    - contextPath: CBP.Connector.CanAnalyze
      description: '"True" if this connector can analyze files. "False" if this connector cannot analyze files.'
      type: Boolean
    - contextPath: CBP.Connector.ConnectorVersion
      description: Version of this connector.
      type: String
    - contextPath: CBP.Connector.Enabled
      description: '"True" if the connector is enabled. "False" if the connector is disabled.'
      type: Boolean
    - contextPath: CBP.Connector.ID
      description: Unique fileAnalysis ID.
      type: String
  - arguments:
    - default: true
      description: ID of the approval request to update.
      name: id
      required: true
    - auto: PREDEFINED
      description: |-
        Resolution of the request. Resolution can be changed for open requests or
        closed requests only. It can be one of:
        0=Not Resolved
        1=Rejected
        2=Resolved - Approved
        3=Resolved - Rule Change4=Resolved - Installer
        5=Resolved - Updater
        6=Resolved - Publisher
        7=Resolved - Other.
      name: resolution
      predefined:
      - Rejected
      - Resolved - Approved
      - Resolved - Rule Change4=Resolved - Installer
      - Resolved - Updater
      - Resolved - Publisher
      - Resolved - Other
      required: true
    - description: Email address of the user that created this request.
      name: requestorEmail
    - description: Comments added by the user that resolved the request.
      name: resolutionComments
    - auto: PREDEFINED
      description: 'Request status. Can be one of: 1=New, 2=Open, 3=Closed, 4=Escalated. Prohibited transitions are from any status back to 0 or 1.'
      name: status
      predefined:
      - New
      - Open
      - Closed
      - Escalated
    description: Resolves a file approval request.
    name: cbp-approvalRequest-resolve
    outputs:
    - contextPath: CBP.ApprovalRequest.ID
      description: ID of the approval request.
      type: Number
    - contextPath: CBP.ApprovalRequest.ResolutionComments
      description: Comments added by the user that resolved the request.
      type: String
    - contextPath: CBP.ApprovalRequest.Resolution
      description: 'Resolution of request. Can be one of: 0=Not Resolved, 1=Rejected, 2=Resolved - Approved, 3=Resolved - Rule Change, 4=Resolved - Installer, 5=Resolved - Updater, 6=Resolved - Publisher, 7=Resolved - Other.'
      type: Number
    - contextPath: CBP.ApprovalRequest.Status
      description: 'Request status. Can be one of: 1=New, 2=Open, 3=Closed, 4=Escalated.'
      type: Number
  - arguments:
    - description: (String) Hash associated with this rule. This parameter is not required if fileCatalogId is supplied.
      name: hash
    - auto: PREDEFINED
      description: '(Int) File state for this rule. Can be one of: 1=Unapproved 2=Approved 3=Banned.'
      name: fileState
      predefined:
      - '1'
      - '2'
      - '3'
      required: true
    - description: (Int) Unique id of this fileRule.
      name: id
    - description: (Int) ID of the fileCatalog entry associated with this fileRule. Can be "0" if creating or modifying the rule based on the hash or file name.
      name: fileCatalogId
    - description: (String) Name of this rule.
      name: name
    - description: (String) Description of this rule.
      name: description
    - auto: PREDEFINED
      description: '(Boolean) If "true", creates a report-only ban. Note: fileState has to be set to "1" (unapproved) before this flag can be set.'
      name: reportOnly
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if reputation approvals are enabled for this file. "False" if reputation approvals are disabled for this file.
      name: 'reputationApprovalsEnabled '
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if this file is forced to act as installer, even if the product detected it as ‘not installer’.
      name: forceInstaller
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if this file is forced to act as ‘not installer’, even if the product detected it as installer.
      name: forceNotInstaller
      predefined:
      - 'true'
      - 'false'
    - description: (String) List of IDs of policies to which this rule applies. Set to "0" if this is a global rule.
      name: policyIds
    - description: '(Int) Set of platform flags where this file rule will be valid. Combination of: 1 = Windows 2 = Mac 4 = Linux.'
      name: platformFlags
    - description: Headers to present of the returned table.
      name: headers
    deprecated: true
    description: 'Creates or updates file rule. See more: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filerule'
    name: cbp-fileRule-update
    outputs:
    - contextPath: CBP.FileRule.CatalogID
      description: The file catalog ID for the rule.
      type: String
    - contextPath: CBP.FileRule.Description
      description: The rule description.
      type: String
    - contextPath: CBP.FileRule.FileState
      description: The file state for the rule.
      type: String
    - contextPath: CBP.FileRule.Hash
      description: The hash for the rule.
      type: String
    - contextPath: CBP.FileRule.ID
      description: The rule ID.
      type: String
    - contextPath: CBP.FileRule.Name
      description: The rule name.
      type: String
    - contextPath: CBP.FileRule.PolicyIDs
      description: The policies this rule belongs to.
      type: String
    - contextPath: CBP.FileRule.ReportOnly
      description: Whether this rule "reporting only" or is also "enforcing".
      type: String
  - arguments:
    - description: (String) Hash associated with this rule. This parameter is not required if the fileCatalogId is supplied.
      name: hash
    - auto: PREDEFINED
      description: '(Int) File state for this rule. Can be one of: 1=Unapproved 2=Approved 3=Banned.'
      name: fileState
      predefined:
      - '1'
      - '2'
      - '3'
      required: true
    - description: (Int) Unique ID of this fileRule.
      name: id
    - description: (Int) ID of the fileCatalog entry associated with this fileRule. Can be "0" if creating or modifying the rule based on the hash or file name. This value can be fetched via cbp-fileCatalog-search command.
      name: fileCatalogId
    - description: (String) Name of this rule.
      name: name
    - description: (String) Description of this rule.
      name: description
    - auto: PREDEFINED
      description: '(Boolean) Set to "true" to create a report-only ban. Note: fileState has to be set to "1" (unapproved) before this flag can be set.'
      name: reportOnly
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if reputation approvals are enabled for this file. "False" if reputation approvals are disabled for this file.
      name: 'reputationApprovalsEnabled'
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if this file is forced to act as installer, even if the product detected it as ‘not installer’.
      name: forceInstaller
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: (Boolean) "True" if this file is forced to act as ‘not installer’, even if the product detected it as installer.
      name: forceNotInstaller
      predefined:
      - 'true'
      - 'false'
    - description: (String) List of IDs of policies to which this rule applies. Set to "0" if this is a global rule.
      name: policyIds
    - description: '(Int) Set of platform flags where this file rule will be valid. combination of: 1 = Windows 2 = Mac 4 = Linux.'
      name: platformFlags
    - description: Headers to present of the returned table.
      name: headers
    description: 'Creates or updates a file rule. For more information, see the Carbon Black documentation: https://developer.carbonblack.com/reference/enterprise-protection/8.0/rest-api/#filerule'
    name: cbp-fileRule-createOrUpdate
    outputs:
    - contextPath: CBP.FileRule.CatalogID
      description: The file catalog ID for the rule.
      type: String
    - contextPath: CBP.FileRule.Description
      description: The rule description.
      type: String
    - contextPath: CBP.FileRule.FileState
      description: The file state for the rule.
      type: String
    - contextPath: CBP.FileRule.Hash
      description: The hash for the rule.
      type: String
    - contextPath: CBP.FileRule.ID
      description: The rule ID.
      type: String
    - contextPath: CBP.FileRule.Name
      description: The rule name.
      type: String
    - contextPath: CBP.FileRule.PolicyIDs
      description: The policies this rule belongs to.
      type: String
    - contextPath: CBP.FileRule.ReportOnly
      description: Is this rule "reporting only" or is it also "enforcing".
      type: String
  - arguments:
    - description: ID of the user to disable. Retrieved from cbp-user-data-get.
      name: user_id
      required: true
    description: Sends request to disable user account.
    name: cbp-user-disable
    compliantpolicies:
    - User Soft Remediation
    outputs:
    - contextPath: CBP.UserDisable.Department
      description: The department of the user.
      type: String
    - contextPath: CBP.UserDisable.EmailAddress
      description: The email of the user.
      type: String
    - contextPath: CBP.UserDisable.Enabled
      description: Whether the account is enabled or disabled.
      type: String
    - contextPath: CBP.UserDisable.ID
      description: The ID of the user in Carbon Black.
      type: String
    - contextPath: CBP.UserDisable.Name
      description: The name of the user account.
      type: String
  - arguments:
    - description: Email address of user account to retrieve data for.
      name: user_email
      required: true
    description: Retrieve all user account data.
    name: cbp-user-data-get
    outputs:
    - contextPath: CBP.UserDisable.Department
      description: The department of the user.
      type: String
    - contextPath: CBP.UserDisable.EmailAddress
      description: The email of the user.
      type: String
    - contextPath: CBP.UserDisable.Enabled
      description: Whether the account is enabled or disabled.
      type: String
    - contextPath: CBP.UserDisable.ID
      description: The ID of the user in Carbon Black.
      type: String
    - contextPath: CBP.UserDisable.Name
      description: The name of the user account.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  subtype: python3
  isfetch: true
  script: ''
  type: python
tests:
- Carbon Black Enterprise Protection V2 Test
fromversion: 5.0.0