VMware Carbon Black EDR v2

VMware Carbon Black EDR (formerly known as Carbon Black Response).

Endpoint · Carbon Black Enterprise Response

Details

IDVMware Carbon Black EDR v2
ProviderBroadcom
CategoryEndpoint
From Version5.5.0
Docker Imagedemisto/python3:3.12.14.12277297
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

VMware Carbon Black EDR (formerly known as Carbon Black Response)
This integration was integrated and tested with product version 6.2 of VMware Carbon Black EDR and based on API version 6.3+.

Some changes have been made that might affect your existing content.

Configure VMware Carbon Black EDR v2 in Cortex

Parameter Description Required
Server URL   True
API Token   False
Fetch incidents   False
Incident type   False
Filter alerts by query Advanced query string. Accepts the same data as the search box on the Alert Search page.
For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf.
If provided, other search filters are not allowed.		 False
Filter alerts by status   False
Filter alerts by feed name   False
Maximum Number Of Incidents To Fetch   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cb-edr-processes-search

Process search

Base Command

cb-edr-processes-search

Input

Argument Name Description Required
process_name The name of the process. Optional
group The CB Host group this sensor is assigned to. Optional
hostname The hostname of the computer for this process. Optional
parent_name The parent process name. Optional
process_path The process path. Optional
md5 The md5 of the binary image backing the process. Optional
query Advanced query string. Accepts the same data as the search box on the Process Search page. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided. Optional
group_by group by a field name. For example, if parameter group=id, search will return one result per process. Note that results will still honor sorting specified by the search. Even within group, it will return result that is first in the sort order. Grouping will be slower (sometimes much slower) than regular results. Optional
sort Sort rows by this field and order. last_update desc by default. Optional
facet Return facet results. ‘false’ by default, set to ‘true’ for facets. Possible values are: true, false. Optional
facet_field facet field name to return. Multiple facet.field parameters can be specified in a query. Possible values are: process_md5, hostname, group, path_full, parent_name, process_name, host_type, hour_of_day, day_of_week, start, username_full. Optional
limit Return this many rows, 10 by default. Optional
start Start at this row, 0 by default. Optional

Context Output

Path Type Description
CarbonBlackEDR.ProcessSearch.Terms String A list of strings, each representing a token as parsed by the query parser.
CarbonBlackEDR.ProcessSearch.Results.process_md5 String The md5 of the binary image backing the process.
CarbonBlackEDR.ProcessSearch.Results.sensor_id Number The internal CB id for the sensor on which the process executed.
CarbonBlackEDR.ProcessSearch.Results.filtering_known_dlls Boolean Whether known dlls are filtered.
CarbonBlackEDR.ProcessSearch.Results.modload_count Number The count of modules loaded in this process.
CarbonBlackEDR.ProcessSearch.Results.parent_unique_id String Internal CB process id of the process’s parent.
CarbonBlackEDR.ProcessSearch.Results.emet_count Number Number of EMET associated with the event.
CarbonBlackEDR.ProcessSearch.Results.cmdline String The command line of the process.
CarbonBlackEDR.ProcessSearch.Results.filemod_count Number The count of file modifications in this process.
CarbonBlackEDR.ProcessSearch.Results.id String The internal CB process id for this process (processes are identified by this id and their segment id).
CarbonBlackEDR.ProcessSearch.Results.parent_name String The name of the process’s parent.
CarbonBlackEDR.ProcessSearch.Results.parent_md5 String The md5 of the process’s parent.
CarbonBlackEDR.ProcessSearch.Results.group String The CB Host group this sensor is assigned to.
CarbonBlackEDR.ProcessSearch.Results.parent_id String The id of the process’s parent.
CarbonBlackEDR.ProcessSearch.Results.hostname String The hostname of the computer for this process.
CarbonBlackEDR.ProcessSearch.Results.last_update Date The time of the most recently received event for this process in remote computer GMT time.
CarbonBlackEDR.ProcessSearch.Results.start Date The start time of the process in remote computer GMT time.
CarbonBlackEDR.ProcessSearch.Results.comms_ip String IP address that the Cb server received the events on. If the endpoint is behind a NAT,
for example, this will be the external IP of the network the endpoint lives on.    
CarbonBlackEDR.ProcessSearch.Results.regmod_count Number The count of registry modifications in this process.
CarbonBlackEDR.ProcessSearch.Results.interface_ip Number The IP address of the network interface(s) on the endpoint that generated the message.
CarbonBlackEDR.ProcessSearch.Results.process_pid Number The pid of the process.
CarbonBlackEDR.ProcessSearch.Results.username String The user assosicated with the process.
CarbonBlackEDR.ProcessSearch.Results.terminated Boolean Whether the process is terminated.
CarbonBlackEDR.ProcessSearch.Results.process_name String The name of the process.
CarbonBlackEDR.ProcessSearch.Results.emet_config String The configuration of the EMET.
CarbonBlackEDR.ProcessSearch.Results.last_server_update Date When the process was last updated in the server.
CarbonBlackEDR.ProcessSearch.Results.path String The full path of the executable backing this process, e.g., c:\windows\system32\svchost.exe.
CarbonBlackEDR.ProcessSearch.Results.netconn_count Number The count of network connections in this process.
CarbonBlackEDR.ProcessSearch.Results.parent_pid Number The pid of the process’s parent.
CarbonBlackEDR.ProcessSearch.Results.crossproc_count Number The count of cross process events launched by this process.
CarbonBlackEDR.ProcessSearch.Results.segment_id String The process segment id (processes are identified by this segment id and their id)
CarbonBlackEDR.ProcessSearch.Results.watchlists.segments_hit String Number of segment hits associated with the watchlist.
CarbonBlackEDR.ProcessSearch.Results.watchlists.wid String The id of the watchlist associated with the process.
CarbonBlackEDR.ProcessSearch.Results.watchlists.value String The value of the watchlist associated with the process.
CarbonBlackEDR.ProcessSearch.Results.host_type String The type of the process’s host.
CarbonBlackEDR.ProcessSearch.Results.processblock_count Number The number of processblock associated with the process.
CarbonBlackEDR.ProcessSearch.Results.os_type String The operating system type of the computer for this process; one of windows, linux, osx.
CarbonBlackEDR.ProcessSearch.Results.childproc_count Number The count of child processes launched by this process.
CarbonBlackEDR.ProcessSearch.Results.unique_id String An internal CB process id combining of the process id and segment id.

Command Example

!cb-edr-processes-search process_name=chrome.exe limit=2

Context Example

{
    "CarbonBlackEDR": {
        "ProcessSearch": {
            "Results": [
                {
                    "childproc_count": 0,
                    "cmdline": "(unknown)",
                    "comms_ip": 314169177,
                    "crossproc_count": 0,
                    "emet_config": "",
                    "emet_count": 0,
                    "filemod_count": 10,
                    "filtering_known_dlls": false,
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-164c-01d5-9ed472b33472",
                    "interface_ip": -1407250960,
                    "last_server_update": "2021-05-26T13:00:03.651Z",
                    "last_update": "2021-05-26T12:51:30.227Z",
                    "modload_count": 0,
                    "netconn_count": 0,
                    "os_type": "windows",
                    "parent_id": "00000018-ffff-ffff-0000-000000000000",
                    "parent_md5": "000000000000000000000000000000",
                    "parent_name": "(unknown)",
                    "parent_pid": -1,
                    "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
                    "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
                    "process_md5": "8698e468bc379e30383a72ce63da7972",
                    "process_name": "chrome.exe",
                    "process_pid": 5708,
                    "processblock_count": 0,
                    "regmod_count": 0,
                    "segment_id": 1622034003651,
                    "sensor_id": 24,
                    "start": "2019-11-19T12:25:37.19Z",
                    "terminated": false,
                    "unique_id": "00000018-0000-164c-01d5-9ed472b33472-0179a8c2b6c3",
                    "username": "EC2AMAZ-L4C2OKC\\Administrator",
                    "watchlists": [
                        {
                            "segments_hit": [
                                1622033757062
                            ],
                            "value": "2021-05-26T13:00:03.333Z",
                            "wid": "1870"
                        }
                    ]
                },
                {
                    "childproc_count": 0,
                    "cmdline": "(unknown)",
                    "comms_ip": 314169177,
                    "crossproc_count": 0,
                    "emet_config": "",
                    "emet_count": 0,
                    "filemod_count": 10,
                    "filtering_known_dlls": false,
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-164c-01d5-9ed472b33472",
                    "interface_ip": -1407250960,
                    "last_server_update": "2021-05-26T13:25:57.176Z",
                    "last_update": "2021-05-26T13:21:30.216Z",
                    "modload_count": 0,
                    "netconn_count": 0,
                    "os_type": "windows",
                    "parent_id": "00000018-ffff-ffff-0000-000000000000",
                    "parent_md5": "000000000000000000000000000000",
                    "parent_name": "(unknown)",
                    "parent_pid": -1,
                    "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
                    "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
                    "process_md5": "8698e468bc379e30383a72ce63da7972",
                    "process_name": "chrome.exe",
                    "process_pid": 5708,
                    "processblock_count": 0,
                    "regmod_count": 0,
                    "segment_id": 1622035557173,
                    "sensor_id": 24,
                    "start": "2019-11-19T12:25:37.19Z",
                    "terminated": false,
                    "unique_id": "00000018-0000-164c-01d5-9ed472b33472-0179a8da6b35",
                    "username": "EC2AMAZ-L4C2OKC\\Administrator"
                }
            ],
            "Terms": [
                "process_name:chrome.exe"
            ],
            "total_results": 3379
        }
    }
}

Human Readable Output

Carbon Black EDR - Process Search Results###

Showing 0 - 2 out of 3379 results.

Process Path Process ID Segment ID Process md5 Process Name Hostname Process PID Username Last Update Is Terminated
c:\program files (x86)\google\chrome\application\chrome.exe 00000018-0000-164c-01d5-9ed472b33472 1622034003651 8698e468bc379e30383a72ce63da7972 chrome.exe ec2amaz-l4c2okc 5708 EC2AMAZ-L4C2OKC\Administrator 2021-05-26T12:51:30.227Z false
c:\program files (x86)\google\chrome\application\chrome.exe 00000018-0000-164c-01d5-9ed472b33472 1622035557173 8698e468bc379e30383a72ce63da7972 chrome.exe ec2amaz-l4c2okc 5708 EC2AMAZ-L4C2OKC\Administrator 2021-05-26T13:21:30.216Z false

cb-edr-process-get

Gets basic process information for segment of process.

Base Command

cb-edr-process-get

Input

Argument Name Description Required
process_id The internal CB process id; this is the id field in search results. Required
segment_id The process segment id, the segment_id field in search results. Required
get_related Whether to get sibling data for process. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
CarbonBlackEDR.Process.process.process_md5 String The md5 of the binary image backing the process.
CarbonBlackEDR.Process.process.sensor_id Number The internal CB id for the sensor on which the process executed.
CarbonBlackEDR.Process.process.uid String The uid of the process.
CarbonBlackEDR.Process.process.filtering_known_dlls Boolean Whether known dlls are filtered.
CarbonBlackEDR.Process.process.modload_count Number The count of modules loaded in this process.
CarbonBlackEDR.Process.process.parent_unique_id String Internal CB process id of the process’s parent.
CarbonBlackEDR.Process.process.cmdline String The command line of the process.
CarbonBlackEDR.Process.process.max_last_update Date The maximum last update of the process.
CarbonBlackEDR.Process.process.min_last_update Date The minimum last update of the process.
CarbonBlackEDR.Process.process.last_update Date The time of the most recently received event for this process in remote computer GMT time.
CarbonBlackEDR.Process.process.id String The id of the process.
CarbonBlackEDR.Process.process.terminated Boolean Whether the process is terminated.
CarbonBlackEDR.Process.process.crossproc_count Number The count of cross process events launched by this process.
CarbonBlackEDR.Process.process.group String The CB Host group this sensor is assigned to.
CarbonBlackEDR.Process.process.max_last_server_update Date When the process was last updated in the server.
CarbonBlackEDR.Process.process.parent_id String The id of the process’s parent.
CarbonBlackEDR.Process.process.hostname String The hostname of the computer for this process.
CarbonBlackEDR.Process.process.filemod_count Number The count of file modifications in this process.
CarbonBlackEDR.Process.process.start Date The start time of the process in remote computer GMT time.
CarbonBlackEDR.Process.process.comms_ip String IP address that the Cb server received the events on. If the endpoint is behind a NAT,
for example, this will be the external IP of the network the endpoint lives on.    
CarbonBlackEDR.Process.process.regmod_count Number The count of registry modifications in this process.
CarbonBlackEDR.Process.process.interface_ip Number The IP address of the network interface(s) on the endpoint that generated the message.
CarbonBlackEDR.Process.process.process_pid Number The pid of the process.
CarbonBlackEDR.Process.process.username String The user assosicated with the process.
CarbonBlackEDR.Process.process.process_name String The name of the process.
CarbonBlackEDR.Process.process.emet_count Number Number of EMET associated with the process.
CarbonBlackEDR.Process.process.last_server_update Date When the process was last updated in the server.
CarbonBlackEDR.Process.process.path String The full path of the executable backing this process, e.g., c:\windows\system32\svchost.exe.
CarbonBlackEDR.Process.process.netconn_count Number The count of network connections in this process.
CarbonBlackEDR.Process.process.parent_pid Number The pid of the process’s parent.
CarbonBlackEDR.Process.process.segment_id Date The process segment id (processes are identified by this segment id and their id)
CarbonBlackEDR.Process.process.min_last_server_update Date When the process was last updated in the server.
CarbonBlackEDR.Process.process.host_type String The Type of the process’s host.
CarbonBlackEDR.Process.process.processblock_count Number The number of processblock associated with the process.
CarbonBlackEDR.Process.process.os_type String The operating system type of the computer for this process; one of windows, linux, osx.
CarbonBlackEDR.Process.process.childproc_count Number The count of child processes launched by this process.
CarbonBlackEDR.Process.process.unique_id String An internal CB process id combining of the process id and segment id
CarbonBlackEDR.Process.siblings.process_md5 String The md5 of the binary image backing the sibling process.
CarbonBlackEDR.Process.siblings.sensor_id Number The internal CB id for the sensor on which the sibling process executed.
CarbonBlackEDR.Process.siblings.uid String The uid of the sibling process.
CarbonBlackEDR.Process.siblings.parent_unique_id String Internal CB process id of the sibling process’s parent.
CarbonBlackEDR.Process.siblings.cmdline String The command line of the sibling process
CarbonBlackEDR.Process.siblings.id String The id of the process.
CarbonBlackEDR.Process.siblings.terminated Boolean Whether the sibling process is terminated.
CarbonBlackEDR.Process.siblings.group String The CB Host group this sensor is assigned to.
CarbonBlackEDR.Process.siblings.parent_id String The id of the sibling process’s parent.
CarbonBlackEDR.Process.siblings.hostname String The hostname of the computer for the sibling process.
CarbonBlackEDR.Process.siblings.last_update Date The time of the most recently received event for the sibling process in remote computer GMT time.
CarbonBlackEDR.Process.siblings.start Date The start time of the sibling process in remote computer GMT time.
CarbonBlackEDR.Process.siblings.process_pid Number The pid of the sibling process.
CarbonBlackEDR.Process.siblings.username String The user assosicated with the process.
CarbonBlackEDR.Process.siblings.process_name String The name of the sibling process.
CarbonBlackEDR.Process.siblings.path String The path of the sibling process.
CarbonBlackEDR.Process.siblings.parent_pid Number The pid of the sibling process’s parent.
CarbonBlackEDR.Process.siblings.segment_id Date The sibling process segment id (processes are identified by this segment id and their id)
CarbonBlackEDR.Process.siblings.host_type String The type of the host associated with the process.
CarbonBlackEDR.Process.siblings.os_type String The operating system type of the computer for the sibling process; one of windows, linux, osx.
CarbonBlackEDR.Process.siblings.child_proc_type String The type of the child process associated with the process.
CarbonBlackEDR.Process.siblings.unique_id String An internal CB process id combining of the sibling process id and segment id
CarbonBlackEDR.Process.children.process_md5 String The md5 of the binary image backing the children process.
CarbonBlackEDR.Process.children.sensor_id Number The internal CB id for the sensor on which the children process executed.
CarbonBlackEDR.Process.children.uid String The uid of the child process.
CarbonBlackEDR.Process.children.parent_unique_id String Internal CB process id of the child process’s parent.
CarbonBlackEDR.Process.children.cmdline String The command line of the child process
CarbonBlackEDR.Process.children.id String The id of the process.
CarbonBlackEDR.Process.children.terminated Boolean Whether the process is terminated.
CarbonBlackEDR.Process.children.group String The CB Host group this sensor is assigned to.
CarbonBlackEDR.Process.children.parent_id String The id of the child process’s parent.
CarbonBlackEDR.Process.children.hostname String The hostname of the computer for the child process.
CarbonBlackEDR.Process.children.last_update Date The time of the most recently received event for the child process in remote computer GMT time.
CarbonBlackEDR.Process.children.start Date The start time of the child process in remote computer GMT time.
CarbonBlackEDR.Process.children.process_pid Number The pid of the child process.
CarbonBlackEDR.Process.children.username String The user assosicated with the process.
CarbonBlackEDR.Process.children.process_name String The name of the child process.
CarbonBlackEDR.Process.children.path String The path of the child process.
CarbonBlackEDR.Process.children.parent_pid Number The pid of the child process’s parent.
CarbonBlackEDR.Process.children.segment_id Date The child process segment id (processes are identified by this segment id and their id)
CarbonBlackEDR.Process.children.host_type String The host type of the children process.
CarbonBlackEDR.Process.children.os_type String The operating system type of the computer for the child process; one of windows, linux, osx.
CarbonBlackEDR.Process.children.child_proc_type String The type of the host associated with the process.
CarbonBlackEDR.Process.children.unique_id String An internal CB process id combining of the child process id and segment id

Command Example

!cb-edr-process-get get_related=true process_id="00000018-0000-164c-01d5-9ed472b33472" segment_id=1622034003651

Context Example

{
    "CarbonBlackEDR": {
        "Process": {
            "children": [
                {
                    "child_proc_type": "exec",
                    "cmdline": "",
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-040c-01d5-c6881466ccfd",
                    "last_update": "2021-05-21T05:02:07.44Z",
                    "os_type": "windows",
                    "parent_id": "00000018-0000-164c-01d5-9ed472b33472",
                    "parent_pid": 5708,
                    "parent_unique_id": "00000018-0000-164c-01d5-9ed472b33472-000000000001",
                    "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
                    "process_md5": "8698e468bc379e30383a72ce63da7972",
                    "process_name": "chrome.exe",
                    "process_pid": 1036,
                    "segment_id": 1621573543800,
                    "sensor_id": 24,
                    "start": "2020-01-09T00:59:43.743Z",
                    "terminated": false,
                    "uid": "S-1-5-21-2523591321-1041074104-504789541-500",
                    "unique_id": "00000018-0000-040c-01d5-c6881466ccfd-01798d50a778",
                    "username": "EC2AMAZ-L4C2OKC\\Administrator"
                },
                {
                    "child_proc_type": "exec",
                    "cmdline": "",
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-083c-01d5-9ed472f57ab4",
                    "last_update": "2021-05-21T05:02:07.222Z",
                    "os_type": "windows",
                    "parent_id": "00000018-0000-164c-01d5-9ed472b33472",
                    "parent_pid": 5708,
                    "parent_unique_id": "00000018-0000-164c-01d5-9ed472b33472-000000000001",
                    "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
                    "process_md5": "8698e468bc379e30383a72ce63da7972",
                    "process_name": "chrome.exe",
                    "process_pid": 2108,
                    "segment_id": 1621573543800,
                    "sensor_id": 24,
                    "start": "2019-11-19T12:25:37.624Z",
                    "terminated": false,
                    "uid": "S-1-5-21-2523591321-1041074104-504789541-500",
                    "unique_id": "00000018-0000-083c-01d5-9ed472f57ab4-01798d50a778",
                    "username": "EC2AMAZ-L4C2OKC\\Administrator"
                }
            ],
            "parent": {},
            "process": {
                "childproc_count": 0,
                "cmdline": "",
                "comms_ip": 314169177,
                "crossproc_count": 0,
                "emet_count": 0,
                "filemod_count": 10,
                "filtering_known_dlls": false,
                "group": "default group",
                "host_type": "server",
                "hostname": "ec2amaz-l4c2okc",
                "id": "00000018-0000-164c-01d5-9ed472b33472",
                "interface_ip": -1407250960,
                "last_server_update": "2021-05-26T13:00:03.651Z",
                "last_update": "2021-05-26T12:51:30.227Z",
                "max_last_server_update": "2021-05-26T13:00:03.651Z",
                "max_last_update": "2021-05-26T12:51:30.227Z",
                "min_last_server_update": "2021-05-26T13:00:03.651Z",
                "min_last_update": "2021-05-26T12:51:30.227Z",
                "modload_count": 0,
                "netconn_count": 0,
                "os_type": "windows",
                "parent_id": "00000018-ffff-ffff-0000-000000000000",
                "parent_pid": -1,
                "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
                "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
                "process_md5": "8698e468bc379e30383a72ce63da7972",
                "process_name": "chrome.exe",
                "process_pid": 5708,
                "processblock_count": 0,
                "ref_segment_id": [
                    1622033757062
                ],
                "regmod_count": 0,
                "segment_id": 1622034003651,
                "sensor_id": 24,
                "start": "2019-11-19T12:25:37.19Z",
                "terminated": false,
                "unique_id": "00000018-0000-164c-01d5-9ed472b33472-0179a8c2b6c3",
                "username": "EC2AMAZ-L4C2OKC\\Administrator"
            },
            "siblings": [
                {
                    "child_proc_type": "exec",
                    "cmdline": "",
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-019c-01d7-61cc9c8a9b67",
                    "last_update": "2021-06-15T13:06:08.907Z",
                    "os_type": "windows",
                    "parent_id": "00000018-ffff-ffff-0000-000000000000",
                    "parent_pid": -1,
                    "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
                    "process_pid": 412,
                    "segment_id": 1623762407950,
                    "sensor_id": 24,
                    "start": "2021-06-15T09:55:45.827Z",
                    "terminated": false,
                    "unique_id": "00000018-0000-019c-01d7-61cc9c8a9b67-017a0fc8120e",
                    "username": ""
                },
                {
                    "child_proc_type": "exec",
                    "cmdline": "",
                    "group": "default group",
                    "host_type": "server",
                    "hostname": "ec2amaz-l4c2okc",
                    "id": "00000018-0000-0228-01d5-9ed00a25b248",
                    "last_update": "2021-05-21T05:02:03.425Z",
                    "os_type": "windows",
                    "parent_id": "00000018-ffff-ffff-0000-000000000000",
                    "parent_pid": -1,
                    "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
                    "path": "c:\\windows\\system32\\winlogon.exe",
                    "process_md5": "e2908e2ded4c0dd15e81eef9087329d2",
                    "process_name": "winlogon.exe",
                    "process_pid": 552,
                    "segment_id": 1621573543800,
                    "sensor_id": 24,
                    "start": "2019-11-19T11:54:03.792Z",
                    "terminated": false,
                    "uid": "S-1-5-18",
                    "unique_id": "00000018-0000-0228-01d5-9ed00a25b248-01798d50a778",
                    "username": "SYSTEM"
                }
            ]
        }
    }
}

Human Readable Output

Carbon Black EDR - Process

Hostname Is Terminated Last Update Process ID Process Name Process PID Process Path Process md5 Segment ID Username
ec2amaz-l4c2okc false 2021-05-26T12:51:30.227Z 00000018-0000-164c-01d5-9ed472b33472 chrome.exe 5708 c:\program files (x86)\google\chrome\application\chrome.exe 8698e468bc379e30383a72ce63da7972 1622034003651 EC2AMAZ-L4C2OKC\Administrator

cb-edr-process-segments-get

Gets segment data for a given process.

Base Command

cb-edr-process-segments-get

Input

Argument Name Description Required
process_id The internal CB process id; this is the id field in search results. Required
limit The maximum amount of segments to be returned. Default is 50. Optional

Context Output

Path Type Description
CarbonBlackEDR.ProcessSegments.last_server_update Date The last date/time when the server pushed events into this segment.
CarbonBlackEDR.ProcessSegments.event_counts.filemod Number The number of events for filemod event type stored in this segment.
CarbonBlackEDR.ProcessSegments.event_counts.netconn Number The number of events for netconn event type stored in this segment.
CarbonBlackEDR.ProcessSegments.event_counts.crossproc Number The number of events for crossproc event type stored in this segment.
CarbonBlackEDR.ProcessSegments.unique_id String The full process ID + segment number associated with this event segment.
CarbonBlackEDR.ProcessSegments.last_update Date The last event (represented in sensor date/time) stored in this segment.

Command Example

!cb-edr-process-segments-get process_id="00000018-0000-164c-01d5-9ed472b33472" limit=2

Context Example

{
    "CarbonBlackEDR": {
        "ProcessSegments": [
            {
                "event_counts": {
                    "filemod": 10
                },
                "last_server_update": "2021-05-20T12:55:42.042Z",
                "last_update": "2021-05-20T12:51:27.7Z",
                "unique_id": "00000018-0000-164c-01d5-9ed472b33472-017989d890d7"
            },
            {
                "event_counts": {},
                "last_server_update": "2021-05-20T13:00:03.484Z",
                "last_update": "2021-05-20T12:51:27.7Z",
                "unique_id": "00000018-0000-164c-01d5-9ed472b33472-017989dc8e17"
            }
        ]
    }
}

Human Readable Output

[
{
“event_counts”: {
“filemod”: 10
},
“last_server_update”: “2021-05-20T12:55:42.042Z”,
“last_update”: “2021-05-20T12:51:27.7Z”,
“unique_id”: “00000018-0000-164c-01d5-9ed472b33472-017989d890d7”
},
{
“event_counts”: {},
“last_server_update”: “2021-05-20T13:00:03.484Z”,
“last_update”: “2021-05-20T12:51:27.7Z”,
“unique_id”: “00000018-0000-164c-01d5-9ed472b33472-017989dc8e17”
}
]

cb-edr-sensor-installer-download

Download a zip archive including a sensor installer for Windows, Mac OS X or Linux.

Base Command

cb-edr-sensor-installer-download

Input

Argument Name Description Required
os_type Download a zip archive including a sensor installer for Windows, Mac OS X or Linux.

For Windows- A ZIP archive which includes a signed Windows EXE or MSI sensor installer and settings file
For Mac OS X- A ZIP archive which includes a signed OSX PKG sensor installer and settings file
For Linux- A compressed tarball (tar.gz) archive which includes a Linux sensor installer and settings file. Possible values are: windows_exe, windows_msi, osx, linux.		 Required
group_id An ID of a group related to sensors. Required

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### cb-edr-process-events-list

***
Gets the events for the process with CB process id (process_id) and segment id (segment_id).

#### Base Command

`cb-edr-process-events-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| process_id | The internal CB process id; this is the id field in search results. | Required |
| segment_id | The process segment id. This is the segment_id field in search results.<br/>If this is set to 0, the API will merge all segments in results. | Required |
| start | Return events starting with this offset.<br/>If not provided, offset will be 0 (returns events starting from the beginning). | Optional |
| count | How many events to fetch. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CarbonBlackEDR.Events.process_md5 | String | The MD5 of the executable backing this process. |
| CarbonBlackEDR.Events.sensor_id | Number | The sensor id of the host this process executed on. |
| CarbonBlackEDR.Events.uid | String | The uid of the event. |
| CarbonBlackEDR.Events.filtering_known_dlls | Boolean | Whether known dlls are filtered. |
| CarbonBlackEDR.Events.modload_count | Number | The count of modules loaded in this process. |
| CarbonBlackEDR.Events.parent_unique_id | String | The id of the parent process. |
| CarbonBlackEDR.Events.cmdline | String | The command line of the process. |
| CarbonBlackEDR.Events.max_last_update | Date | The time of last update. |
| CarbonBlackEDR.Events.min_last_update | Date | The time of last update. |
| CarbonBlackEDR.Events.last_update | Date | The time of the last event received from this process, as recorded by the remote host. |
| CarbonBlackEDR.Events.id | String | The internal CB process id of this process. |
| CarbonBlackEDR.Events.terminated | Boolean | Whether the event is terminated. |
| CarbonBlackEDR.Events.crossproc_count | Number | The count of cross process events launched by this process. |
| CarbonBlackEDR.Events.group | String | The sensor group the sensor was assigned to. |
| CarbonBlackEDR.Events.max_last_server_update | Date | Time of server last update. |
| CarbonBlackEDR.Events.parent_id | String | The Carbon Black process id of the parent process. |
| CarbonBlackEDR.Events.hostname | String | The hostname of the computer this process executed on. |
| CarbonBlackEDR.Events.filemod_count | Number | The count of file modifications in this process. |
| CarbonBlackEDR.Events.start | Date | The start time of this process, as recorded by the remote host. |
| CarbonBlackEDR.Events.comms_ip | Number | IP address that the Cb server received the events on. If the endpoint is behind a NAT,
for example, this will be the external IP of the network the endpoint lives on. |
| CarbonBlackEDR.Events.regmod_count | Number | The count of registry modifications in this process. |
| CarbonBlackEDR.Events.interface_ip | Number | The IP address of the network interface\(s\) on the endpoint that generated the message. |
| CarbonBlackEDR.Events.process_pid | Number | The pid of the process. |
| CarbonBlackEDR.Events.username | String | The user assosicated with the event. |
| CarbonBlackEDR.Events.process_name | String | The name of this process, e.g., svchost.exe. |
| CarbonBlackEDR.Events.emet_count | Number | Number of EMET associated with the event. |
| CarbonBlackEDR.Events.last_server_update | Date | When the event was last updated in the server. |
| CarbonBlackEDR.Events.path | String | The full path of the executable backing this process, e.g., c:\\windows\\system32\\svchost.exe . |
| CarbonBlackEDR.Events.netconn_count | Number | The count of network connections in this process. |
| CarbonBlackEDR.Events.parent_pid | Number | The pid of the process's parent. |
| CarbonBlackEDR.Events.segment_id | Date | The segment id of this process. |
| CarbonBlackEDR.Events.min_last_server_update | Date | When the event was last updated in the server. |
| CarbonBlackEDR.Events.host_type | String | The host type associated with the event. |
| CarbonBlackEDR.Events.processblock_count | Number | The number of processblock associated with the process. |
| CarbonBlackEDR.Events.filemod_complete.operation_type | String | The operation type.
One of Created the file, First wrote to the file, Deleted the file, Last wrote to the file. |
| CarbonBlackEDR.Events.filemod_complete.event_time | Date | The event time. |
| CarbonBlackEDR.Events.filemod_complete.file_path | String | The file path. |
| CarbonBlackEDR.Events.filemod_complete.md5_after_last_write | String | The md5 of the file after the last write. |
| CarbonBlackEDR.Events.filemod_complete.file_type | String | The file type, if known. One of: PE, Elf, UniversalBin, EICAR, OfficeLegacy, OfficeOpenXml,
Pdf, ArchivePkzip, ArchiveLzh, ArchiveLzw, ArchiveRar, ArchiveTar, Archive7zip. |
| CarbonBlackEDR.Events.filemod_complete.flagged_as_potential_tamper_attempt | String | Whether event is flagged as potential tamper attempt. |
| CarbonBlackEDR.Events.modload_complete.event_time | Date | The event time. |
| CarbonBlackEDR.Events.modload_complete.loaded_module_md5 | String | MD5 of the loaded module. |
| CarbonBlackEDR.Events.modload_complete.loaded_module_full_path | String | Full path of the loaded module. |
| CarbonBlackEDR.Events.regmod_complete.operation_type | String | The operation type.
One of Created the file, First wrote to the file, Deleted the file, Last wrote to the file. |
| CarbonBlackEDR.Events.regmod_complete.event_time | Date | The event time. |
| CarbonBlackEDR.Events.regmod_complete.registry_key_path | String | The registry key path. |
| CarbonBlackEDR.Events.crossproc_complete.cross-process_access_type | String | The type of cross-process access:
RemoteThread if remote thread creation; ProcessOpen if process handle open with access privileges. |
| CarbonBlackEDR.Events.crossproc_complete.event_time | Date | The event time. |
| CarbonBlackEDR.Events.crossproc_complete.targeted_process_unique_id | String | The unique_id of the targeted process. |
| CarbonBlackEDR.Events.crossproc_complete.targeted_process_md5 | String | The md5 of the targeted process. |
| CarbonBlackEDR.Events.crossproc_complete.targeted_process_path | String | The path of the targeted process. |
| CarbonBlackEDR.Events.crossproc_complete.ProcessOpen_sub-type | String | The sub-type for ProcessOpen. |
| CarbonBlackEDR.Events.crossproc_complete.requested_access_priviledges | String | The requested access priviledges. |
| CarbonBlackEDR.Events.crossproc_complete.flagged_as_potential_tamper_attempt | String | Whether event is flagged as potential tamper attempt. |
| CarbonBlackEDR.Events.os_type | String | The operating system type of the computer for this process. |
| CarbonBlackEDR.Events.binaries | String | The binaries associated with the event. |
| CarbonBlackEDR.Events.childproc_count | Number | The count of child processes launched by this process. |
| CarbonBlackEDR.Events.unique_id | String | The unique_id of the Event. |

#### Command Example

```!cb-edr-process-events-list process_id="00000018-0000-164c-01d5-9ed472b33472" segment_id=1622034003651 count=2```

#### Context Example

```json
{
    "CarbonBlackEDR": {
        "Events": {
            "binaries": {
                "8698E468BC379E30383A72CE63DA7972": {
                    "digsig_publisher": "Google LLC",
                    "digsig_result": "Signed"
                }
            },
            "childproc_count": 0,
            "cmdline": "",
            "comms_ip": 314169177,
            "crossproc_count": 0,
            "emet_count": 0,
            "filemod_count": 10,
            "filtering_known_dlls": false,
            "group": "default group",
            "host_type": "server",
            "hostname": "ec2amaz-l4c2okc",
            "id": "00000018-0000-164c-01d5-9ed472b33472",
            "interface_ip": -1407250960,
            "last_server_update": "2021-05-26T13:00:03.651Z",
            "last_update": "2021-05-26T12:51:30.227Z",
            "max_last_server_update": "2021-05-26T13:00:03.651Z",
            "max_last_update": "2021-05-26T12:51:30.227Z",
            "min_last_server_update": "2021-05-26T13:00:03.651Z",
            "min_last_update": "2021-05-26T12:51:30.227Z",
            "modload_count": 0,
            "netconn_count": 0,
            "os_type": "windows",
            "parent_id": "00000018-ffff-ffff-0000-000000000000",
            "parent_pid": -1,
            "parent_unique_id": "00000018-ffff-ffff-0000-000000000000-000000000001",
            "path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
            "process_md5": "8698e468bc379e30383a72ce63da7972",
            "process_name": "chrome.exe",
            "process_pid": 5708,
            "processblock_count": 0,
            "ref_segment_id": [
                1622033757062
            ],
            "regmod_count": 0,
            "segment_id": 1622034003651,
            "sensor_id": 24,
            "start": "2019-11-19T12:25:37.19Z",
            "terminated": false,
            "unique_id": "00000018-0000-164c-01d5-9ed472b33472-0179a8c2b6c3",
            "username": "EC2AMAZ-L4C2OKC\\Administrator"
        }
    }
}

Human Readable Output

{
“binaries”: {
“8698E468BC379E30383A72CE63DA7972”: {
“digsig_publisher”: “Google LLC”,
“digsig_result”: “Signed”
}
},
“childproc_count”: 0,
“cmdline”: “”,
“comms_ip”: 314169177,
“crossproc_count”: 0,
“emet_count”: 0,
“filemod_count”: 10,
“filtering_known_dlls”: false,
“group”: “default group”,
“host_type”: “server”,
“hostname”: “ec2amaz-l4c2okc”,
“id”: “00000018-0000-164c-01d5-9ed472b33472”,
“interface_ip”: -1407250960,
“last_server_update”: “2021-05-26T13:00:03.651Z”,
“last_update”: “2021-05-26T12:51:30.227Z”,
“max_last_server_update”: “2021-05-26T13:00:03.651Z”,
“max_last_update”: “2021-05-26T12:51:30.227Z”,
“min_last_server_update”: “2021-05-26T13:00:03.651Z”,
“min_last_update”: “2021-05-26T12:51:30.227Z”,
“modload_count”: 0,
“netconn_count”: 0,
“os_type”: “windows”,
“parent_id”: “00000018-ffff-ffff-0000-000000000000”,
“parent_pid”: -1,
“parent_unique_id”: “00000018-ffff-ffff-0000-000000000000-000000000001”,
“path”: “c:\program files (x86)\google\chrome\application\chrome.exe”,
“process_md5”: “8698e468bc379e30383a72ce63da7972”,
“process_name”: “chrome.exe”,
“process_pid”: 5708,
“processblock_count”: 0,
“ref_segment_id”: [
1622033757062
],
“regmod_count”: 0,
“segment_id”: 1622034003651,
“sensor_id”: 24,
“start”: “2019-11-19T12:25:37.19Z”,
“terminated”: false,
“unique_id”: “00000018-0000-164c-01d5-9ed472b33472-0179a8c2b6c3”,
“username”: “EC2AMAZ-L4C2OKC\Administrator”
}

cb-edr-unquarantine-device

Unquarantine the endpoint

Base Command

cb-edr-unquarantine-device

Input

Argument Name Description Required
sensor_id The sensor ID to quarantine. Required

Context Output

There is no context output for this command.

Command Example

!cb-edr-unquarantine-device sensor_id=15

Human Readable Output

Sensor was un-isolated successfully.

cb-edr-quarantine-device

Isolate the endpoint from the network

Base Command

cb-edr-quarantine-device

Input

Argument Name Description Required
sensor_id The sensor ID to quarantine. Required

Context Output

There is no context output for this command.

Command Example

!cb-edr-quarantine-device sensor_id=15

Human Readable Output

Sensor was isolated successfully.

cb-edr-sensors-list

List the CarbonBlack sensors

Base Command

cb-edr-sensors-list

Input

Argument Name Description Required
id The sensor ID. Optional
ip Returns the sensor registration(s) with specified IP address. Possible values are: . Optional
group_id Retruns the sensor registration(s) in the specified sensor group id. Optional
inactive_filter_days only returns sensors that have been inactive for less than the specified number of days. Optional
hostname Returns the sensor registration(s) with matching hostname. Optional
limit The maximum amount of sensors to be returned. Optional

Context Output

Path Type Description
CarbonBlackEDR.Sensor.systemvolume_total_size String The size, in bytes, of system volume of endpoint on which sensor in installed.
CarbonBlackEDR.Sensor.emet_telemetry_path String The path of emet telemtry associated with the sensor.
CarbonBlackEDR.Sensor.os_environment_display_string String Human-readable string of the installed OS.
CarbonBlackEDR.Sensor.emet_version String The emet version associated with the sensor.
CarbonBlackEDR.Sensor.emet_dump_flags String The flags of emet dump associated with the sensor.
CarbonBlackEDR.Sensor.clock_delta String The clock delta associated with the sensor.
CarbonBlackEDR.Sensor.supports_cblr Boolean Whether the sensor supports cblr.
CarbonBlackEDR.Sensor.sensor_uptime String The uptime of the process.
CarbonBlackEDR.Sensor.last_update String When the sensor last updated.
CarbonBlackEDR.Sensor.physical_memory_size Date The size in bytes of physical memory.
CarbonBlackEDR.Sensor.build_id Number The sensor version installed on this endpoint. From the /api/builds/ endpoint.
CarbonBlackEDR.Sensor.uptime String Endpoint uptime in seconds.
CarbonBlackEDR.Sensor.is_isolating Boolean Boolean representing sensor-reported isolation status.
CarbonBlackEDR.Sensor.event_log_flush_time Date If event_log_flush_time is set, the server will instruct the sensor to immediately send all data before this date, ignoring all other throttling mechansims. To force a host current, set this value to a value far in the future. When the sensor has finished sending its queued data, this value will be null.
CarbonBlackEDR.Sensor.computer_dns_name String The DNS name of the endpoint on which the sensor is installed.
CarbonBlackEDR.Sensor.emet_report_setting String The report setting of EMET associated with sensor.
CarbonBlackEDR.Sensor.id Number The sensor id of this sensor.
CarbonBlackEDR.Sensor.emet_process_count Number The number of EMET processes associated with the sensor.
CarbonBlackEDR.Sensor.emet_is_gpo Boolean Whther the EMET is gpo.
CarbonBlackEDR.Sensor.power_state Number The sensor power state.
CarbonBlackEDR.Sensor.network_isolation_enabled Boolean Boolean representing network isolation request status.
CarbonBlackEDR.Sensor.systemvolume_free_size Date The bytes free on the system volume.
CarbonBlackEDR.Sensor.status String The sensor status.
CarbonBlackEDR.Sensor.num_eventlog_bytes String Number bytes of eventlog.
CarbonBlackEDR.Sensor.sensor_health_message String Human-readable string indicating sensor’s self-reported status.
CarbonBlackEDR.Sensor.build_version_string String Human-readable string of the sensor version.
CarbonBlackEDR.Sensor.computer_sid String Machine SID of this host.
CarbonBlackEDR.Sensor.next_checkin_time String Next expected communication from this computer in server-local time and zone.
CarbonBlackEDR.Sensor.node_id Number The node ID associated with the sensor.
CarbonBlackEDR.Sensor.cookie Number The cookie associated with the sensor.
CarbonBlackEDR.Sensor.emet_exploit_action String The EMET exploit action associated with the sensor.
CarbonBlackEDR.Sensor.computer_name String NetBIOS name of this computer.
CarbonBlackEDR.Sensor.license_expiration Date When the licene of the sensor expires.
CarbonBlackEDR.Sensor.supports_isolation Boolean Whther sensor supports isolation.
CarbonBlackEDR.Sensor.parity_host_id String The ID of the parity host associated with the sensor.
CarbonBlackEDR.Sensor.supports_2nd_gen_modloads Boolean Whether the sensor support modload of 2nd generation.
CarbonBlackEDR.Sensor.network_adapters String A pipe-delimited list list of IP,MAC pairs for each network interface.
CarbonBlackEDR.Sensor.sensor_health_status Number self-reported health score, from 0 to 100. Higher numbers are better.
CarbonBlackEDR.Sensor.registration_time String Time this sensor originally registered in server-local time and zone.
CarbonBlackEDR.Sensor.restart_queued Boolean Whether a restart of the sensot is queued.
CarbonBlackEDR.Sensor.notes String The notes associated with the sensor.
CarbonBlackEDR.Sensor.num_storefiles_bytes String Number of storefiles bytes associated with the sensor.
CarbonBlackEDR.Sensor.os_environment_id Number The ID of the os enviroment of the sensor.
CarbonBlackEDR.Sensor.shard_id Number The ID of the shard associated with the sensor.
CarbonBlackEDR.Sensor.boot_id String A sequential counter of boots since the sensor was installed.
CarbonBlackEDR.Sensor.last_checkin_time String Last communication with this computer in server-local time and zone.
CarbonBlackEDR.Sensor.os_type Number The operating system type of the computer.
CarbonBlackEDR.Sensor.group_id Number The sensor group id this sensor is assigned to.
CarbonBlackEDR.Sensor.display Boolean Deprecated.
CarbonBlackEDR.Sensor.uninstall Boolean when set, indicates sensor will be directed to uninstall on next checkin.

Command Example

!cb-edr-sensors-list limit=2

Context Example

{
    "CarbonBlackEDR": {
        "Sensor": [
            {
                "boot_id": "5",
                "build_id": 2,
                "build_version_string": "006.001.002.71109",
                "clock_delta": "0",
                "computer_dns_name": "WIN-SOSSKVTTQAB",
                "computer_name": "WIN-SOSSKVTTQAB",
                "computer_sid": "S-1-5-21-3953612773-3739516437-1294407085",
                "cookie": 465121924,
                "display": true,
                "emet_dump_flags": "",
                "emet_exploit_action": " (Locally configured)",
                "emet_is_gpo": false,
                "emet_process_count": 0,
                "emet_report_setting": " (Locally configured)",
                "emet_telemetry_path": "",
                "emet_version": "",
                "event_log_flush_time": null,
                "group_id": 1,
                "id": 15,
                "is_isolating": false,
                "last_checkin_time": "2021-06-20 13:46:07.891689+00:00",
                "last_update": "2021-06-20 13:46:12.614699+00:00",
                "license_expiration": "1990-01-01 00:00:00+00:00",
                "network_adapters": "x.x.x.x,06d3d4a5ba28|",
                "network_isolation_enabled": false,
                "next_checkin_time": "2021-06-20 13:46:38.890886+00:00",
                "node_id": 0,
                "notes": null,
                "num_eventlog_bytes": "0",
                "num_storefiles_bytes": "0",
                "os_environment_display_string": "Windows Server 2012 R2 Server Standard, 64-bit",
                "os_environment_id": 1,
                "os_type": 1,
                "parity_host_id": "0",
                "physical_memory_size": "1073332224",
                "power_state": 0,
                "registration_time": "2018-08-26 13:00:02.811470+00:00",
                "restart_queued": false,
                "sensor_health_message": "Svc Component Failure",
                "sensor_health_status": 20,
                "sensor_uptime": "50049182",
                "shard_id": 0,
                "status": "Online",
                "supports_2nd_gen_modloads": false,
                "supports_cblr": true,
                "supports_isolation": true,
                "systemvolume_free_size": "7761645568",
                "systemvolume_total_size": "31843151872",
                "uninstall": false,
                "uninstalled": null,
                "uptime": "83808602"
            },
            {
                "boot_id": "1",
                "build_id": 2,
                "build_version_string": "006.001.002.71109",
                "clock_delta": "0",
                "computer_dns_name": "EC2AMAZ-L4C2OKC",
                "computer_name": "EC2AMAZ-L4C2OKC",
                "computer_sid": "S-1-5-21-2523591321-1041074104-504789541",
                "cookie": 1176535804,
                "display": true,
                "emet_dump_flags": "",
                "emet_exploit_action": " (Locally configured)",
                "emet_is_gpo": false,
                "emet_process_count": 0,
                "emet_report_setting": " (GPO configured)",
                "emet_telemetry_path": "",
                "emet_version": "",
                "event_log_flush_time": null,
                "group_id": 1,
                "id": 24,
                "is_isolating": false,
                "last_checkin_time": "2021-06-20 13:45:57.690995+00:00",
                "last_update": "2021-06-20 13:46:02.824545+00:00",
                "license_expiration": "1990-01-01 00:00:00+00:00",
                "network_adapters": "x.x.x.x,0a02fe5a854e|",
                "network_isolation_enabled": false,
                "next_checkin_time": "2021-06-20 13:46:26.689805+00:00",
                "node_id": 0,
                "notes": null,
                "num_eventlog_bytes": "0",
                "num_storefiles_bytes": "0",
                "os_environment_display_string": "Windows 10 Server Server Datacenter, 64-bit",
                "os_environment_id": 5,
                "os_type": 1,
                "parity_host_id": "0",
                "physical_memory_size": "4231622656",
                "power_state": 0,
                "registration_time": "2019-11-19 12:27:21.530043+00:00",
                "restart_queued": false,
                "sensor_health_message": "Elevated memory usage",
                "sensor_health_status": 85,
                "sensor_uptime": "42419698",
                "shard_id": 0,
                "status": "Online",
                "supports_2nd_gen_modloads": false,
                "supports_cblr": true,
                "supports_isolation": true,
                "systemvolume_free_size": "71386714112",
                "systemvolume_total_size": "107372081152",
                "uninstall": false,
                "uninstalled": null,
                "uptime": "50030889"
            }
        ]
    }
}

Human Readable Output

Carbon Black EDR - Sensors

Sensor Id Computer Name Status Power State Group ID OS Version Health Score Is Isolating Node Id Sensor Version IP Address/MAC Info
15 WIN-SOSSKVTTQAB Online 0 1 1 20 false 0 006.001.002.71109 06d3d4a5ba28
24 EC2AMAZ-L4C2OKC Online 0 1 1 85 false 0 006.001.002.71109 0a02fe5a854e

Showing 2 out of 24 results.

cb-edr-watchlist-delete

Delete a Watchlist that is specified using ID.

Base Command

cb-edr-watchlist-delete

Input

Argument Name Description Required
id Delete a watchlist in Carbon black Response. Required

Context Output

There is no context output for this command.

Command Example

!cb-edr-watchlist-delete id=2412

Human Readable Output

success

cb-edr-watchlist-update

Updates a Watchlist that is specified using ID.

Base Command

cb-edr-watchlist-update

Input

Argument Name Description Required
id The watchlist ID. Required
search_query The raw Carbon Black query that this watchlist matches. Optional
description A description of the update. Optional
enabled Whether the watchlist is enabled or not. Optional

Context Output

There is no context output for this command.

Command Example

!cb-edr-watchlist-update id=2406 description="example description" search_query=chrome.exe

Human Readable Output

success

cb-edr-watchlist-update-action

Updates a Watchlist action that is specified using ID.

Base Command

cb-edr-watchlist-update-action

Input

Argument Name Description Required
id The watchlist ID. Required
action_type Action type specified for the watchlist. Options are syslog, email and alert. Required
enabled Whether the watchlist is enabled or not. Required

Context Output

There is no context output for this command.

Command Example

!cb-edr-watchlist-update id=2406 action_type=alert enabled=True

Human Readable Output

success

cb-edr-watchlist-create

Creates a new Watchlist within EDR,

Base Command

cb-edr-watchlist-create

Input

Argument Name Description Required
name Name of the watchlist. Required
search_query The raw Carbon Black query that this watchlist matches. Required
description A description of the update. Optional
index_type the type of watchlist. Valid values are ‘modules’ and ‘events’ for binary and process watchlists, respectively. Deafult is ‘events’. Optional

Context Output

Path Type Description
CarbonBlackEDR.Watchlist.id Number An ID for the new watchlist

Command Example

!cb-edr-watchlist-create name=example_name search_query=chrome.exe

Context Example

{
    "CarbonBlackEDR": {
        "Watchlist": {
            "id": 2414
        }
    }
}

Human Readable Output

Successfully created new watchlist with id 2414

cb-edr-watchlists-list

Retrieve watchlist in Carbon black Response.

Base Command

cb-edr-watchlists-list

Input

Argument Name Description Required
id The watchlist ID. Optional
limit The maximum amount of watchlists to be returned. Optional

Context Output

Path Type Description
CarbonBlackEDR.Watchlist.last_hit_count Number A count of lifetime watchlist matches.
CarbonBlackEDR.Watchlist.description String A description of the watchlist.
CarbonBlackEDR.Watchlist.search_query String The raw Carbon Black query that this watchlist matches.
CarbonBlackEDR.Watchlist.enabled Boolean Whether the watchlist is enabled.
CarbonBlackEDR.Watchlist.search_timestamp Date Time of the search associated with the watchlist.
CarbonBlackEDR.Watchlist.index_type String The type of watchlist.
Valid values are ‘modules’ and ‘events’ for binary and process watchlists, respectively.    
CarbonBlackEDR.Watchlist.readonly Boolean Whether the watchlist is readonly.
CarbonBlackEDR.Watchlist.total_hits String The number of total hits associated with the watchlist.
CarbonBlackEDR.Watchlist.date_added String The date this watchlist was created on this Enterprise Server.
CarbonBlackEDR.Watchlist.group_id Number The sensor group id this watchlist is assigned to.
CarbonBlackEDR.Watchlist.total_tags String The number of total tags associated with the watchlist.
CarbonBlackEDR.Watchlist.id String The id of this watchlist.
CarbonBlackEDR.Watchlist.last_hit Date A timestamp of the last time this watchlist triggered a match.
CarbonBlackEDR.Watchlist.name String The name of this watchlist.

Command Example

!cb-edr-watchlists-list limit=2

Context Example

{
    "CarbonBlackEDR": {
        "Watchlist": [
            {
                "date_added": "2019-03-27 13:15:10.858750+00:00",
                "description": "updating description for playbook test.",
                "enabled": true,
                "group_id": -1,
                "id": "1870",
                "index_type": "events",
                "last_hit": "2021-06-03 11:20:04.064133+00:00",
                "last_hit_count": 1,
                "name": "chrome",
                "readonly": false,
                "search_query": "chrome.exe",
                "search_timestamp": "2021-06-03 11:20:03.732105",
                "total_hits": "9071",
                "total_tags": "5360"
            },
            {
                "date_added": "2019-06-13 15:09:59.469919+00:00",
                "description": "updating description for playbook test.",
                "enabled": true,
                "group_id": -1,
                "id": "2163",
                "index_type": "events",
                "last_hit": "2021-04-04 11:40:05.832123+00:00",
                "last_hit_count": 50,
                "name": "Example-ipaddr:x.x.x.x",
                "readonly": false,
                "search_query": "chrome.exe",
                "search_timestamp": "2021-06-03 11:20:03.732105",
                "total_hits": "198",
                "total_tags": "198"
            }
        ]
    }
}

Human Readable Output

Carbon Black EDR - Watchlists###
Showing 2 out of 33 results.

Description Group ID ID Name Query Total Hits
updating description for playbook test. -1 1870 chrome chrome.exe 9071
updating description for playbook test. -1 2163 David-ipaddr:x.x.x.x chrome.exe 198

cb-edr-binary-ban

Prevent execution of a specified md5 hash

Base Command

cb-edr-binary-ban

Input

Argument Name Description Required
md5 The banned hash. Required
text Text description of block list. Required
last_ban_time The last time the hash was blocked or prevented from being executed. Optional
ban_count Total number of blocks on the banned list. Optional
last_ban_host Last hostname to block this hash. Optional

Context Output

There is no context output for this command.

Command Example

!cb-edr-binary-ban md5=0ea59cf80ef9703b3d92ca6b25426458 text=example

Human Readable Output

Ban for md5 0ea59cf80ef9703b3d92ca6b25426458 already exists

cb-edr-binary-bans-list

Returns a list of banned hashes

Base Command

cb-edr-binary-bans-list

Input

Argument Name Description Required
limit The maximum hashs of result to retrieve. Required

Context Output

Path Type Description
CarbonBlackEDR.BinaryBan.username String The username who banned the record.
CarbonBlackEDR.BinaryBan.audit.username String The user assosicated with the binary ban.
CarbonBlackEDR.BinaryBan.audit.timestamp Date The time of the binary ban.
CarbonBlackEDR.BinaryBan.audit.text String The text assosicated with the binary ban.
CarbonBlackEDR.BinaryBan.audit.enabled Boolean Whether the binary ban is enabled.
CarbonBlackEDR.BinaryBan.audit.user_id Number The user ID assosiated with binary ban.
CarbonBlackEDR.BinaryBan.text String The text description of banned record.
CarbonBlackEDR.BinaryBan.md5hash String The banned hash.
CarbonBlackEDR.BinaryBan.block_count Number The total number of blocks on the banned list.
CarbonBlackEDR.BinaryBan.user_id Number The id of the user who banned the record.
CarbonBlackEDR.BinaryBan.last_block_sensor_id String The last sensor id which prevented the hash from executing.
CarbonBlackEDR.BinaryBan.enabled Boolean Whether the ban is enabled.
CarbonBlackEDR.BinaryBan.last_block_time Date The last time the hash was blocked or prevented from being executed.
CarbonBlackEDR.BinaryBan.timestamp String The date and time the record was banned.
CarbonBlackEDR.BinaryBan.last_block_hostname String The last hostname to block this hash.

Command Example

!cb-edr-binary-bans-list limit=2

Context Example

{
    "CarbonBlackEDR": {
        "BinaryBan": [
            {
                "audit": [
                    {
                        "enabled": true,
                        "text": "test",
                        "timestamp": "2021-06-10 06:25:58.431602+00:00",
                        "user_id": 1,
                        "username": "admin"
                    }
                ],
                "block_count": 0,
                "enabled": true,
                "last_block_hostname": null,
                "last_block_sensor_id": null,
                "last_block_time": null,
                "md5hash": "0ea59cf80ef9703b3d92ca6b25426456",
                "text": "test",
                "timestamp": "2021-06-10 06:25:58.431602+00:00",
                "user_id": 1,
                "username": "admin"
            },
            {
                "audit": [
                    {
                        "enabled": true,
                        "text": "testing",
                        "timestamp": "2021-05-25 11:41:56.151008+00:00",
                        "user_id": 1,
                        "username": "admin"
                    }
                ],
                "block_count": 0,
                "enabled": true,
                "last_block_hostname": null,
                "last_block_sensor_id": null,
                "last_block_time": null,
                "md5hash": "0ea59cf80ef9703b3d92ca6b25426458",
                "text": "testing",
                "timestamp": "2021-05-25 11:41:56.151008+00:00",
                "user_id": 1,
                "username": "admin"
            }
        ]
    }
}

Human Readable Output

Carbon Black EDR -Banned Hashes

Text Timestamp User ID Username md5
test 2021-06-10 06:25:58.431602+00:00 1 admin 0ea59cf80ef9703b3d92ca6b25426456
testing 2021-05-25 11:41:56.151008+00:00 1 admin 0ea59cf80ef9703b3d92ca6b25426458

cb-edr-alert-update

Alerts update and resolution.
Updating Alerts requires an API key with Global Administrator privileges.

Base Command

cb-edr-alert-update

Input

Argument Name Description Required
alert_ids Alert unique identifier. Required
status The requested status to
. Possible values are: Resolved, Unresolved, In Progress, False Positive.		 Optional
set_ignored Setting is_ignored to True for an Alert carries through to the threat report that generated the Alert. Any further hits on IOCs contained within that report will no longer trigger an Alert. Possible values are: true, false. Optional
query Advanced query string. Accepts the same data as the search box on the Process Search page. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided. Optional

Context Output

There is no context output for this command.

Command Example

!cb-edr-alert-update alert_ids=9f67733c-0632-4c55-bae0-985d9440c207 status=Unresolved

Human Readable Output

Alert was updated successfully.

cb-edr-alert-search

Retrieve alerts from Carbon Black Response.

Base Command

cb-edr-alert-search

Input

Argument Name Description Required
status Alert status to filter by. Possible values are: Unresolved, In Progress, Resolved, False Positive. Optional
username Alert username to filter by. Optional
feedname Alert feedname to filter by. Optional
hostname Alert hostname to filter by. Optional
report Alert report name (watchlist_id) to filter by. Optional
query Advanced query string. Accepts the same data as the search box. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided. Optional
sort Sort rows by this field and order. server_added_timestamp desc by default. Optional
facet Return facet results. ‘false’ by default, set to ‘true’ for facets. Optional
limit Maximum number of alerts to show, 10 by default. Optional

Context Output

Path Type Description
CarbonBlackEDR.Alert.Terms String A list of strings, each representing a token as parsed by the query parser.
CarbonBlackEDR.Alert.Results.username String The user assosicated with the alert.
CarbonBlackEDR.Alert.Results.alert_type String The type of the alert.
CarbonBlackEDR.Alert.Results.sensor_criticality Number The criticality of the sensor.
CarbonBlackEDR.Alert.Results.modload_count Number The count of modules loaded.
CarbonBlackEDR.Alert.Results.report_score Number The score of the report.
CarbonBlackEDR.Alert.Results.watchlist_id String The id of the watchlist.
CarbonBlackEDR.Alert.Results.sensor_id Number The id of the sensor.
CarbonBlackEDR.Alert.Results.feed_name String The name of the source feed
CarbonBlackEDR.Alert.Results.created_time Date The alert creation time.
CarbonBlackEDR.Alert.Results.report_ignored Boolean Whether the alert report should be ignored.
CarbonBlackEDR.Alert.Results.ioc_type String The type of the resource.
CarbonBlackEDR.Alert.Results.watchlist_name String The name of the watchlist.
CarbonBlackEDR.Alert.Results.ioc_confidence Number The confience of the resource.
CarbonBlackEDR.Alert.Results.ioc_attr String The resource attributes.
CarbonBlackEDR.Alert.Results.alert_severity Number The severity of the alert.
CarbonBlackEDR.Alert.Results.crossproc_count Number The count of cross process events launched by this process.
CarbonBlackEDR.Alert.Results.group String The sensor group id this sensor is assigned to.
CarbonBlackEDR.Alert.Results.hostname String The hostname assisicated with the alert.
CarbonBlackEDR.Alert.Results.filemod_count Number The count of file modifications in this process.
CarbonBlackEDR.Alert.Results.comms_ip String IP address that the Cb server received the alert on. If the endpoint is behind a NAT,
for example, this will be the external IP of the network the endpoint lives on.    
CarbonBlackEDR.Alert.Results.netconn_count Number The count of network connections in this process.
CarbonBlackEDR.Alert.Results.interface_ip String The IP address of the network interface(s) on the endpoint that generated the message.
CarbonBlackEDR.Alert.Results.status String The status of the alert. One of Resolved, Unresolved, In Progress, or False Positive.
CarbonBlackEDR.Alert.Results.process_path String The path of the process.
CarbonBlackEDR.Alert.Results.description String The description of the alert.
CarbonBlackEDR.Alert.Results.process_name String The name of the process.
CarbonBlackEDR.Alert.Results.process_unique_id String The unique_id of the targeted process.
CarbonBlackEDR.Alert.Results.process_id String The id of the process.
CarbonBlackEDR.Alert.Results.link String A link to the report.
CarbonBlackEDR.Alert.Results.version Number The version of the alert.
CarbonBlackEDR.Alert.Results.regmod_count Number The count of registry modifications in this process.
CarbonBlackEDR.Alert.Results.md5 String The md5 of the process.
CarbonBlackEDR.Alert.Results.segment_id Date The segment id of the process.
CarbonBlackEDR.Alert.Results.total_hosts Number The number of total host.
CarbonBlackEDR.Alert.Results.feed_id Number The id of the source feed.
CarbonBlackEDR.Alert.Results.ioc_value String The value of the resource.
CarbonBlackEDR.Alert.Results.os_type String The operating system type of the computer for this process; one of windows, linux, osx.
CarbonBlackEDR.Alert.Results.childproc_count Number The count of processes launched by this process.
CarbonBlackEDR.Alert.Results.unique_id String The unique_id of the alert.
CarbonBlackEDR.Alert.Results.feed_rating Number The rating of the Source feed.

Command Example

!cb-edr-alert-search status=Unresolved limit=2

Context Example

{
    "CarbonBlackEDR": {
        "Alert": {
            "Results": [
                {
                    "_version_": 1594835491213017000,
                    "alert_severity": 60.75,
                    "alert_type": "watchlist.hit.ingress.process",
                    "childproc_count": 0,
                    "comms_ip": "x.x.x.x",
                    "created_time": "2018-03-13T15:07:26.805Z",
                    "crossproc_count": 0,
                    "description": "Carbon Black Process Blocking",
                    "feed_id": 3,
                    "feed_name": "cbbanning",
                    "feed_rating": 3,
                    "filemod_count": 0,
                    "group": "default group",
                    "hostname": "win-sosskvttqab",
                    "interface_ip": "x.x.x.x",
                    "ioc_attr": "{\"hit_field_processblock\": true, \"hit_field_result\": \"NotTerminatedWhitelistedPath\", \"hit_field_md5\": \"e3a2ad05e24105b35e986cf9cb38ec47\", \"hit_field_path\": \"c:\\\\windows\\\\system32\\\\svchost.exe\"}",
                    "ioc_confidence": 0.5,
                    "ioc_type": "class",
                    "ioc_value": "com.carbonblack.cbfs.ingress_search.detectors.SensorProtectionBlock$ProcessBlocking",
                    "link": "https://www.carbonblack.com/cbfeeds/processbanningevents_feed.xhtml",
                    "md5": "e3a2ad05e24105b35e986cf9cb38ec47",
                    "modload_count": 0,
                    "netconn_count": 1,
                    "os_type": "windows",
                    "process_id": "00000001-0000-0670-01d3-8a07a3ec10cf",
                    "process_name": "svchost.exe",
                    "process_path": "c:\\windows\\system32\\svchost.exe",
                    "process_unique_id": "00000001-0000-0670-01d3-8a07a3ec10cf-01621fe6de82",
                    "regmod_count": 0,
                    "report_ignored": true,
                    "report_score": 90,
                    "segment_id": 1520953646722,
                    "sensor_criticality": 3,
                    "sensor_id": 1,
                    "status": "Unresolved",
                    "total_hosts": "2",
                    "unique_id": "5d652495-cca6-4bca-9007-579a5ee984a2",
                    "username": "NETWORK SERVICE",
                    "watchlist_id": "process_blocking",
                    "watchlist_name": "process_blocking"
                },
                {
                    "_version_": 1594835491214065700,
                    "alert_severity": 60.75,
                    "alert_type": "watchlist.hit.ingress.process",
                    "childproc_count": 0,
                    "comms_ip": "x.x.x.x",
                    "created_time": "2018-03-13T15:07:26.814Z",
                    "crossproc_count": 0,
                    "description": "Carbon Black Process Blocking",
                    "feed_id": 3,
                    "feed_name": "cbbanning",
                    "feed_rating": 3,
                    "filemod_count": 0,
                    "group": "default group",
                    "hostname": "win-sosskvttqab",
                    "interface_ip": "x.x.x.x",
                    "ioc_attr": "{\"hit_field_processblock\": true, \"hit_field_result\": \"NotTerminatedWhitelistedPath\", \"hit_field_md5\": \"e3a2ad05e24105b35e986cf9cb38ec47\", \"hit_field_path\": \"c:\\\\windows\\\\system32\\\\svchost.exe\"}",
                    "ioc_confidence": 0.5,
                    "ioc_type": "class",
                    "ioc_value": "com.carbonblack.cbfs.ingress_search.detectors.SensorProtectionBlock$ProcessBlocking",
                    "link": "https://www.carbonblack.com/cbfeeds/processbanningevents_feed.xhtml",
                    "md5": "e3a2ad05e24105b35e986cf9cb38ec47",
                    "modload_count": 0,
                    "netconn_count": 0,
                    "os_type": "windows",
                    "process_id": "00000001-0000-0308-01d3-8a07a1d86867",
                    "process_name": "svchost.exe",
                    "process_path": "c:\\windows\\system32\\svchost.exe",
                    "process_unique_id": "00000001-0000-0308-01d3-8a07a1d86867-01621fe6de82",
                    "regmod_count": 0,
                    "report_ignored": true,
                    "report_score": 90,
                    "segment_id": 1520953646722,
                    "sensor_criticality": 3,
                    "sensor_id": 1,
                    "status": "Unresolved",
                    "total_hosts": "2",
                    "unique_id": "aa86855f-e53e-4c78-859a-4a8c87072389",
                    "username": "NETWORK SERVICE",
                    "watchlist_id": "process_blocking",
                    "watchlist_name": "process_blocking"
                }
                
            ],
            "Terms": [
                "status:Unresolved"
            ],
            "total_results": 9669
        }
    }
}

Human Readable Output

Carbon Black EDR - Alert Search Results###
Showing 0 - 2 out of 9669 results.

Alert ID Created Time File Name File Path Hostname Segment ID Severity Source md5 Status
5d652495-cca6-4bca-9007-579a5ee984a2 2018-03-13T15:07:26.805Z svchost.exe c:\windows\system32\svchost.exe win-sosskvttqab 1520953646722 60.75 e3a2ad05e24105b35e986cf9cb38ec47 Unresolved
aa86855f-e53e-4c78-859a-4a8c87072389 2018-03-13T15:07:26.814Z svchost.exe c:\windows\system32\svchost.exe win-sosskvttqab 1520953646722 60.75 e3a2ad05e24105b35e986cf9cb38ec47 Unresolved

cb-edr-binary-summary

Returns the metadata for the binary with the provided md5

Base Command

cb-edr-binary-summary

Input

Argument Name Description Required
md5 The md5 of the binary. Required

Context Output

| Path | Type | Description |
| — | — | — |
| CarbonBlackEDR.BinaryMetadata.host_count | Number | The number of host for the targeted file. |
| CarbonBlackEDR.BinaryMetadata.digsig_result | String | Digital signature status.
One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
Untrusted Root, or Explicit Distrust. |
| CarbonBlackEDR.BinaryMetadata.observed_filename | String | A list of strings, one per unique filename this binary has been seen as. |
| CarbonBlackEDR.BinaryMetadata.product_version | String | If present, Product version from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.digsig_issuer | String | If signed and present, the issuer name. |
| CarbonBlackEDR.BinaryMetadata.signed | String | Digital signature status.
One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
Untrusted Root, or Explicit Distrust. |
| CarbonBlackEDR.BinaryMetadata.digsig_sign_time | Date | If signed, the timestamp of the signature in GMT. |
| CarbonBlackEDR.BinaryMetadata.orig_mod_len | Number | Filesize in bytes. |
| CarbonBlackEDR.BinaryMetadata.is_executable_image | Boolean | Whether the file is an EXE. |
| CarbonBlackEDR.BinaryMetadata.is_64bit | Boolean | Whether the file is x64. |
| CarbonBlackEDR.BinaryMetadata.digsig_subject | String | If signed and present, the subject. |
| CarbonBlackEDR.BinaryMetadata.digsig_publisher | String | If signed and present, the publisher name. |
| CarbonBlackEDR.BinaryMetadata.group | String | A list of 0 or more sensor groups (by name) in which this binary was observed. |
| CarbonBlackEDR.BinaryMetadata.event_partition_id | Number | The ID of the event partition associated with the binary file. |
| CarbonBlackEDR.BinaryMetadata.file_version | String | If present, File version from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.company_name | String | If present, Company name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.internal_name | String | If present, Internal name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.icon | String | The icon of the file. |
| CarbonBlackEDR.BinaryMetadata.product_name | String | If present, Product name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.digsig_result_code | String | HRESULT_FROM_WIN32 for the result of the digital signature operation via WinVerifyTrust. |
| CarbonBlackEDR.BinaryMetadata.timestamp | Date | The time of the file search. |
| CarbonBlackEDR.BinaryMetadata.copied_mod_len | Number | Bytes copied from remote host, if file is > 25MB this will be less than orig_mod_len. |
| CarbonBlackEDR.BinaryMetadata.server_added_timestamp | Date | The first time this binary was received on the server in the server GMT time. |
| CarbonBlackEDR.BinaryMetadata.facet_id | Number | The id of the facet searched. |
| CarbonBlackEDR.BinaryMetadata.digsig_prog_name | String | If signed and present, the program name. |
| CarbonBlackEDR.BinaryMetadata.md5 | String | The md5 hash of this binary. |
| CarbonBlackEDR.BinaryMetadata.endpoint | String | A list of 0 or more hostname, sensorid tuples on which this binary was observed.
The | character serves as the delimiter between the hostname and the sensorid. |
| CarbonBlackEDR.BinaryMetadata.watchlists.wid | String | The wid of the watchlist. |
| CarbonBlackEDR.BinaryMetadata.watchlists.value | Date | The value of the watchlist. |
| CarbonBlackEDR.BinaryMetadata.legal_copyright | String | If present, Legal copyright from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.original_filename | String | If present, Original filename from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.cb_version | Number | The version of Carbon Black. |
| CarbonBlackEDR.BinaryMetadata.os_type | String | The operating system type of the computer for this process; one of windows, linux, osx. |
| CarbonBlackEDR.BinaryMetadata.file_desc | String | If present, File description from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinaryMetadata.last_seen | Date | The last seen time of the file. |

Command Example

!cb-edr-binary-summary md5=9532bd6c36a788d329668ac0d30ce822

Human Readable Output

File 9532bd6c36a788d329668ac0d30ce822 could not be found

cb-edr-binary-download

Download the binary with this md5 hash.

Base Command

cb-edr-binary-download

Input

Argument Name Description Required
md5 The md5 hash of the binary. Required

Context Output

There is no context output for this command.

Command Example

!cb-edr-binary-download md5=e3a2ad05e24105b35e986cf9cb38ec47

Context Example

{
    "InfoFile": {
        "EntryID": "941@7ef46214-11bc-457d-84bc-19826ac7661c",
        "Extension": "zip",
        "Info": "application/zip",
        "Name": "binary_e3a2ad05e24105b35e986cf9cb38ec47.zip",
        "Size": 19452,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

cb-edr-binary-search

Binary search

Base Command

cb-edr-binary-search

Input

Argument Name Description Required
product_name Gets the name of the product this file is distributed with. Optional
md5 The md5 hash of this binary. Optional
digital_signature Digital signature status. Possible values are: Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain, Untrusted Root, Explicit Distrust. Optional
publisher If signed and present, the publisher name. Optional
company_name The name of the company that produced the file. Optional
group Sensor group this sensor was
assigned to at the time of process
execution.		 Optional
hostname Hostname of the computer on
which the process was executed.		 Optional
sort Sort rows by this field and order. server_added_timestamp desc by default. Optional
observed_filename Full path of the binary at the time
of collection.		 Optional
query Advanced query string. Accepts the same data as the search box. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided. Optional
facet Return facet results. ‘false’ by default, set to ‘true’ for facets. Optional
facet_field facet field name to return. Multiple facet.field parameters can be specified in a query. Optional
limit Return this many rows, 10 by default. Optional
start Start at this row, 0 by default. Optional

Context Output

| Path | Type | Description |
| — | — | — |
| CarbonBlackEDR.BinarySearch.terms | String | A list of strings, each representing a token as parsed by the query parser. |
| CarbonBlackEDR.BinarySearch.total_results | Number | The number of matching binaries. |
| CarbonBlackEDR.BinarySearch.highlights | String | A list of highlight objects matching the query string. Format the same as the process event object. |
| CarbonBlackEDR.BinarySearch.Results.host_count | Number | The count of unique endpoints which have ever reported this binary. |
| CarbonBlackEDR.BinarySearch.Results.original_filename | String | If present, Original filename from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.legal_copyright | String | If present, Legal copyright from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.digsig_result | String | Digital signature status.
One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
Untrusted Root, or Explicit Distrust. |
| CarbonBlackEDR.BinarySearch.Results.observed_filename | String | A list of strings, one per unique filename this binary has been seen as. |
| CarbonBlackEDR.BinarySearch.Results.product_version | String | If present, Product version from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.watchlists.wid | String | The wid of the watchlist. |
| CarbonBlackEDR.BinarySearch.Results.watchlists.value | Date | The value of the watchlist. |
| CarbonBlackEDR.BinarySearch.Results.facet_id | Number | The id of the facet searched. |
| CarbonBlackEDR.BinarySearch.Results.digsig_issuer | String | If signed and present, the issuer name. |
| CarbonBlackEDR.BinarySearch.Results.copied_mod_len | Number | Bytes copied from remote host, if file is > 25MB this will be less than orig_mod_len. |
| CarbonBlackEDR.BinarySearch.Results.comments | String | Comments of the search. |
| CarbonBlackEDR.BinarySearch.Results.digsig_sign_time | Date | If signed, the timestamp of the signature in GMT. |
| CarbonBlackEDR.BinarySearch.Results.digsig_prog_name | String | If signed and present, the program name. |
| CarbonBlackEDR.BinarySearch.Results.orig_mod_len | Number | Filesize in bytes. |
| CarbonBlackEDR.BinarySearch.Results.is_executable_image | Boolean | Whether the file is an EXE. |
| CarbonBlackEDR.BinarySearch.Results.is_64bit | Boolean | Whether the file is x64. |
| CarbonBlackEDR.BinarySearch.Results.md5 | String | The md5 hash of this binary. |
| CarbonBlackEDR.BinarySearch.Results.digsig_subject | String | If signed and present, the subject. |
| CarbonBlackEDR.BinarySearch.Results.digsig_publisher | String | If signed and present, the publisher name. |
| CarbonBlackEDR.BinarySearch.Results.endpoint | String | A list of 0 or more hostname, sensorid tuples on which this binary was observed.
The | character serves as the delimiter between the hostname and the sensorid. |
| CarbonBlackEDR.BinarySearch.Results.group | String | A list of 0 or more sensor groups (by name) in which this binary was observed. |
| CarbonBlackEDR.BinarySearch.results.event_partition_id | Number | The ID of the event partition associated with the binary file. |
| CarbonBlackEDR.BinarySearch.Results.digsig_result_code | String | HRESULT_FROM_WIN32 for the result of the digital signature operation via WinVerifyTrust. |
| CarbonBlackEDR.BinarySearch.Results.file_version | String | If present, File version from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.signed | String | Digital signature status: One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature,
Invalid Chain, Untrusted Root, or Explicit Distrust. |
| CarbonBlackEDR.BinarySearch.Results.last_seen | Date | The last seen time of the file. |
| CarbonBlackEDR.BinarySearch.Results.company_name | String | If present, Company name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.internal_name | String | If present, Internal name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.timestamp | Date | Search creation time. |
| CarbonBlackEDR.BinarySearch.Results.cb_version | Number | The version of Carbon Black. |
| CarbonBlackEDR.BinarySearch.Results.os_type | String | The operating system type of this binary; one of windows, linux, osx. |
| CarbonBlackEDR.BinarySearch.Results.file_desc | String | If present, File description from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.product_name | String | If present, Product name from FileVersionInformation. For more information check
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |
| CarbonBlackEDR.BinarySearch.Results.server_added_timestamp | Date | The first time this binary was received on the server in the server GMT time. |
| CarbonBlackEDR.BinarySearch.Results.private_build | String | If present, Private build from FileVersionInformation. For more information check https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0 |

Command Example

!cb-edr-binary-search company_name=Microsoft limit=2

Context Example

{
    "CarbonBlackEDR": {
        "BinarySearch": {
            "Results": [
                {
                    "cb_version": 620,
                    "company_name": "Microsoft Corporation",
                    "copied_mod_len": 33792,
                    "digsig_publisher": "Microsoft Corporation",
                    "digsig_result": "Signed",
                    "digsig_result_code": "0",
                    "digsig_sign_time": "2007-02-18T08:57:00Z",
                    "endpoint": [
                        "amazon-39d8d1e7|4"
                    ],
                    "event_partition_id": [
                        99358576345088
                    ],
                    "facet_id": 326727,
                    "file_desc": "Microsoft Traffic Control 1.0 DLL",
                    "file_version": "5.2.3790.3959 (srv03_sp2_rtm.070216-1710)",
                    "group": [
                        "default group"
                    ],
                    "host_count": 1,
                    "internal_name": "traffic.dll",
                    "is_64bit": false,
                    "is_executable_image": false,
                    "last_seen": "2018-01-17T08:00:05.631Z",
                    "legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
                    "md5": "83263B667637FD878685D6A8401742CB",
                    "observed_filename": [
                        "c:\\windows\\system32\\traffic.dll"
                    ],
                    "orig_mod_len": 33792,
                    "original_filename": "traffic.dll",
                    "os_type": "Windows",
                    "product_name": "Microsoft\u00ae Windows\u00ae Operating System",
                    "product_version": "5.2.3790.3959",
                    "server_added_timestamp": "2018-01-17T00:58:55.134Z",
                    "signed": "Signed",
                    "timestamp": "2018-01-17T00:58:55.134Z",
                    "watchlists": [
                        {
                            "value": "2018-01-17T08:00:04.753Z",
                            "wid": "5"
                        }
                    ]
                },
                {
                    "cb_version": 620,
                    "company_name": "Microsoft Corporation",
                    "copied_mod_len": 99328,
                    "digsig_publisher": "Microsoft Corporation",
                    "digsig_result": "Signed",
                    "digsig_result_code": "0",
                    "digsig_sign_time": "2007-02-18T08:57:00Z",
                    "endpoint": [
                        "amazon-39d8d1e7|4"
                    ],
                    "event_partition_id": [
                        99358576345088
                    ],
                    "facet_id": 738306,
                    "file_desc": "Microsoft Smart Card API",
                    "file_version": "5.2.3790.3959 (srv03_sp2_rtm.070216-1710)",
                    "group": [
                        "default group"
                    ],
                    "host_count": 1,
                    "internal_name": "winscard.dll",
                    "is_64bit": false,
                    "is_executable_image": false,
                    "last_seen": "2018-01-17T08:00:05.664Z",
                    "legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
                    "md5": "ED870A44064799B7DCEA3F9B674D0077",
                    "observed_filename": [
                        "c:\\windows\\system32\\winscard.dll"
                    ],
                    "orig_mod_len": 99328,
                    "original_filename": "winscard.dll",
                    "os_type": "Windows",
                    "product_name": "Microsoft\u00ae Windows\u00ae Operating System",
                    "product_version": "5.2.3790.3959",
                    "server_added_timestamp": "2018-01-17T00:43:41.895Z",
                    "signed": "Signed",
                    "timestamp": "2018-01-17T00:43:41.895Z",
                    "watchlists": [
                        {
                            "value": "2018-01-17T08:00:04.753Z",
                            "wid": "5"
                        }
                    ]
                }
            ],
            "Terms": [
                "company_name:Microsoft"
            ],
            "total_results": 9585
        }
    }
}

Human Readable Output

Carbon Black EDR - Binary Search Results###
Showing 0 - 2 out of 9585 results.

md5 Group OS Type Host Count Last Seen Is Executable Image Timestamp
83263B667637FD878685D6A8401742CB default group Windows 1 2018-01-17T08:00:05.631Z false 2018-01-17T00:58:55.134Z
ED870A44064799B7DCEA3F9B674D0077 default group Windows 1 2018-01-17T08:00:05.664Z false 2018-01-17T00:43:41.895Z

endpoint

Display information about the given sensor

Base Command

endpoint

Input

Argument Name Description Required
id The sensor ID. Optional
ip Query sensors with specified IP address. Optional
hostname Query sensors with matching hostname. Optional

Context Output

Path Type Description
Endpoint.Hostname String The endpoint’s hostname.
Endpoint.Relationships.EntityA string The source of the relationship.
Endpoint.Relationships.EntityB string The destination of the relationship.
Endpoint.Relationships.Relationship string The name of the relationship.
Endpoint.Relationships.EntityAType string The type of the source of the relationship.
Endpoint.Relationships.EntityBType string The type of the destination of the relationship.
Endpoint.OS String The endpoint’s operation system.
Endpoint.IPAddress String The endpoint’s IP address.
Endpoint.ID String The endpoint’s ID.
Endpoint.Status String The endpoint’s status.
Endpoint.IsIsolated String The endpoint’s isolation status.
Endpoint.MACAddress String The endpoint’s MAC address.
Endpoint.Vendor String The integration name of the endpoint vendor.
Endpoint.Domain String The endpoint’s domain.
Endpoint.DHCPServer String The DHCP server of the endpoint.
Endpoint.OSVersion String The endpoint’s operation system version.
Endpoint.BIOSVersion String The endpoint’s BIOS version.
Endpoint.Model String The model of the machine or device.
Endpoint.Memory Int Memory on this endpoint.
Endpoint.Processors Int The number of processors.
Endpoint.Processor String The model of the processor.

Command Example

!endpoint id=15 ip=x.x.x.x hostname=WIN-SOSSKVTTQAB using="VMware Carbon Black EDR_instance_1"

Context Example

{
    "Endpoint": {
        "Hostname": "WIN-SOSSKVTTQAB",
        "ID": "15",
        "IPAddress": "x.x.x.x",
        "IsIsolated": "No",
        "MACAddress": "06d3d4a5ba28",
        "Memory": "1073332224",
        "OSVersion": "Windows Server 2012 R2 Server Standard, 64-bit",
        "Status": "Online",
        "Vendor": "Carbon Black Response"
    }
}

Human Readable Output

Carbon Black EDR - Endpoint: 15

Hostname ID IPAddress IsIsolated MACAddress Memory OSVersion Status Vendor
WIN-SOSSKVTTQAB 15 x.x.x.x No ~~~~~~~~ 06d3d4a5ba28 1073332224 Windows Server 2012 R2 Server Standard, 64-bit Online Carbon Black Response

Configuration parameters

  • url — Server URL (required)
  • credentials —
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • alert_query — Filter alerts by query
  • alert_status — Filter alerts by status
  • alert_feed_name — Filter alerts by feed name
  • max_fetch — Maximum Number Of Incidents To Fetch
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (21)

  • cb-edr-alert-search

    Retrieve alerts from Carbon Black Response.

  • cb-edr-alert-update

    Alerts update and resolution. Updating Alerts requires an API key with Global Administrator privileges.

  • cb-edr-binary-ban

    Prevent execution of a specified md5 hash.

  • cb-edr-binary-bans-list

    Returns a list of banned hashes.

  • cb-edr-binary-download

    Download the binary with this md5 hash.

  • cb-edr-binary-search

    Binary search.

  • cb-edr-binary-summary

    Returns the metadata for the binary with the provided md5.

  • cb-edr-process-events-list

    Gets the events for the process with CB process id (process_id) and segment id (segment_id).

  • cb-edr-process-get

    Gets basic process information for segment of process.

  • cb-edr-process-segments-get

    Gets segment data for a given process.

  • cb-edr-processes-search

    Process search.

  • cb-edr-quarantine-device

    Isolate the endpoint from the network.

  • cb-edr-sensor-installer-download

    Download a zip archive including a sensor installer for Windows, Mac OS X or Linux.

  • cb-edr-sensors-list

    List the CarbonBlack sensors.

  • cb-edr-unquarantine-device

    Unquarantine the endpoint.

  • cb-edr-watchlist-create

    Creates a new Watchlist within EDR,.

  • cb-edr-watchlist-delete

    Delete a Watchlist that is specified using ID.

  • cb-edr-watchlist-update

    Updates a Watchlist that is specified using ID.

  • cb-edr-watchlist-update-action

    Updates a Watchlist action that is specified using ID.

  • cb-edr-watchlists-list

    Retrieve watchlist in Carbon black Response.

  • endpoint

    Display information about the given sensor.

Source

CarbonBlackResponseV2.py CarbonBlackResponseV2_test.py CarbonBlackResponseV2.yml CarbonBlackResponseV2_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Broadcom
sectionorder:
- Connect
- Collect
commonfields:
  id: VMware Carbon Black EDR v2
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Token
  name: credentials
  type: 9
  hiddenusername: true
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Filter alerts by query
  additionalinfo: |-
    Advanced query string. Accepts the same data as the search box on the Alert Search page.
    For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf.
    If provided, other search filters are not allowed.
  name: alert_query
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Filter alerts by status
  name: alert_status
  options:
  - Resolved
  - Unresolved
  - In Progress
  - False Positive
  defaultvalue: Unresolved
  type: 16
  section: Collect
  advanced: true
  required: false
- display: Filter alerts by feed name
  name: alert_feed_name
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: '50'
  display: Maximum Number Of Incidents To Fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: VMware Carbon Black EDR (formerly known as Carbon Black Response).
display: VMware Carbon Black EDR v2
name: VMware Carbon Black EDR v2
script:
  commands:
  - arguments:
    - description: The name of the process.
      name: process_name
    - description: The CB Host group this sensor is assigned to.
      name: group
    - description: The hostname of the computer for this process.
      name: hostname
    - description: The parent process name.
      name: parent_name
    - description: The process path.
      name: process_path
    - description: The md5 of the binary image backing the process.
      name: md5
    - description: Advanced query string. Accepts the same data as the search box on the Process Search page. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided.
      name: query
    - description: group by a field name. For example, if parameter group=id, search will return one result per process. Note that results will still honor sorting specified by the search. Even within group, it will return result that is first in the sort order. Grouping will be slower (sometimes much slower) than regular results.
      name: group_by
    - description: Sort rows by this field and order. last_update desc by default.
      name: sort
    - description: Return facet results. ‘false’ by default, set to ‘true’ for facets.
      name: facet
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: facet field name to return. Multiple facet.field parameters can be specified in a query.
      name: facet_field
      predefined:
      - process_md5
      - hostname
      - group
      - path_full
      - parent_name
      - process_name
      - host_type
      - hour_of_day
      - day_of_week
      - start
      - username_full
    - description: Return this many rows, 10 by default.
      name: limit
    - description: Start at this row, 0 by default.
      name: start
    description: Process search.
    name: cb-edr-processes-search
    outputs:
    - contextPath: CarbonBlackEDR.ProcessSearch.Terms
      description: A list of strings, each representing a token as parsed by the query parser.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.process_md5
      description: The md5 of the binary image backing the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.sensor_id
      description: The internal CB id for the sensor on which the process executed.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.filtering_known_dlls
      description: Whether known dlls are filtered.
      type: Boolean
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.modload_count
      description: The count of modules loaded in this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.parent_unique_id
      description: Internal CB process id of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.emet_count
      description: Number of EMET associated with the event.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.cmdline
      description: The command line of the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.filemod_count
      description: The count of file modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.id
      description: |-
        The internal CB process id for this process (processes are identified by this id and their segment id).
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.parent_name
      description: The name of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.parent_md5
      description: The md5 of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.group
      description: The CB Host group this sensor is assigned to.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.parent_id
      description: The id of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.hostname
      description: The hostname of the computer for this process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.last_update
      description: The time of the most recently received event for this process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.start
      description: The start time of the process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.comms_ip
      description: |-
        IP address that the Cb server received the events on. If the endpoint is behind a NAT,
        for example, this will be the external IP of the network the endpoint lives on.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.regmod_count
      description: The count of registry modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.interface_ip
      description: The IP address of the network interface(s) on the endpoint that generated the message.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.process_pid
      description: The pid of the process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.username
      description: The user assosicated with the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.terminated
      description: Whether the process is terminated.
      type: Boolean
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.process_name
      description: The name of the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.emet_config
      description: The configuration of the EMET.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.last_server_update
      description: When the process was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.path
      description: The full path of the executable backing this process, e.g., c:\windows\system32\svchost.exe.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.netconn_count
      description: The count of network connections in this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.parent_pid
      description: The pid of the process's parent.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.crossproc_count
      description: The count of cross process events launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.segment_id
      description: The process segment id (processes are identified by this segment id and their id).
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.watchlists.segments_hit
      description: Number of segment hits associated with the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.watchlists.wid
      description: The id of the watchlist associated with the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.watchlists.value
      description: The value of the watchlist associated with the process.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.host_type
      description: The type of the process's host.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.processblock_count
      description: The number of processblock associated with the process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.os_type
      description: The operating system type of the computer for this process; one of windows, linux, osx.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.childproc_count
      description: The count of child processes launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSearch.Results.unique_id
      description: An internal CB process id combining of the process id and segment id.
      type: String
  - arguments:
    - description: The internal CB process id; this is the id field in search results.
      name: process_id
      required: true
    - description: The process segment id, the segment_id field in search results.
      name: segment_id
      required: true
    - defaultValue: 'false'
      description: Whether to get sibling data for process.
      name: get_related
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Gets basic process information for segment  of process.
    name: cb-edr-process-get
    outputs:
    - contextPath: CarbonBlackEDR.Process.process.process_md5
      description: The md5 of the binary image backing the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.sensor_id
      description: The internal CB id for the sensor on which the process executed.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.uid
      description: The uid of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.filtering_known_dlls
      description: Whether known dlls are filtered.
      type: Boolean
    - contextPath: CarbonBlackEDR.Process.process.modload_count
      description: The count of modules loaded in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.parent_unique_id
      description: Internal CB process id of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.cmdline
      description: The command line of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.max_last_update
      description: The maximum last update of the process.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.min_last_update
      description: The minimum last update of the process.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.last_update
      description: The time of the most recently received event for this process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.id
      description: The id of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.terminated
      description: Whether the process is terminated.
      type: Boolean
    - contextPath: CarbonBlackEDR.Process.process.crossproc_count
      description: The count of cross process events launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.group
      description: The CB Host group this sensor is assigned to.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.max_last_server_update
      description: When the process was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.parent_id
      description: The id of the process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.hostname
      description: The hostname of the computer for this process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.filemod_count
      description: The count of file modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.start
      description: The start time of the process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.comms_ip
      description: |-
        IP address that the Cb server received the events on. If the endpoint is behind a NAT,
        for example, this will be the external IP of the network the endpoint lives on.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.regmod_count
      description: The count of registry modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.interface_ip
      description: The IP address of the network interface(s) on the endpoint that generated the message.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.process_pid
      description: The pid of the process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.username
      description: The user assosicated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.process_name
      description: The name of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.emet_count
      description: Number of EMET associated with the process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.last_server_update
      description: When the process was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.path
      description: The full path of the executable backing this process, e.g., c:\windows\system32\svchost.exe.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.netconn_count
      description: The count of network connections in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.parent_pid
      description: The pid of the process's parent.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.segment_id
      description: The process segment id (processes are identified by this segment id and their id).
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.min_last_server_update
      description: When the process was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.Process.process.host_type
      description: The Type of the process's host.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.processblock_count
      description: The number of processblock associated with the process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.os_type
      description: The operating system type of the computer for this process; one of windows, linux, osx.
      type: String
    - contextPath: CarbonBlackEDR.Process.process.childproc_count
      description: The count of child processes launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.process.unique_id
      description: An internal CB process id combining of the process id and segment id.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.process_md5
      description: The md5 of the binary image backing the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.sensor_id
      description: The internal CB id for the sensor on which the sibling process executed.
      type: Number
    - contextPath: CarbonBlackEDR.Process.siblings.uid
      description: The uid of the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.parent_unique_id
      description: Internal CB process id of the sibling process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.cmdline
      description: The command line of the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.id
      description: The id of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.terminated
      description: Whether the sibling process is terminated.
      type: Boolean
    - contextPath: CarbonBlackEDR.Process.siblings.group
      description: The CB Host group this sensor is assigned to.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.parent_id
      description: The id of the sibling process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.hostname
      description: The hostname of the computer for the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.last_update
      description: The time of the most recently received event for the sibling process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.siblings.start
      description: The start time of the sibling process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.siblings.process_pid
      description: The pid of the sibling process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.siblings.username
      description: The user assosicated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.process_name
      description: The name of the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.path
      description: The path of the sibling process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.parent_pid
      description: The pid of the sibling process's parent.
      type: Number
    - contextPath: CarbonBlackEDR.Process.siblings.segment_id
      description: The sibling process segment id (processes are identified by this segment id and their id).
      type: Date
    - contextPath: CarbonBlackEDR.Process.siblings.host_type
      description: The type of the host associated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.os_type
      description: The operating system type of the computer for the sibling process; one of windows, linux, osx.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.child_proc_type
      description: The type of the child process associated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.siblings.unique_id
      description: An internal CB process id combining of the sibling process id and segment id.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.process_md5
      description: The md5 of the binary image backing the children process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.sensor_id
      description: The internal CB id for the sensor on which the children process executed.
      type: Number
    - contextPath: CarbonBlackEDR.Process.children.uid
      description: The uid of the child process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.parent_unique_id
      description: Internal CB process id of the child process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.cmdline
      description: The command line of the child process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.id
      description: The id of the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.terminated
      description: Whether the process is terminated.
      type: Boolean
    - contextPath: CarbonBlackEDR.Process.children.group
      description: The CB Host group this sensor is assigned to.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.parent_id
      description: The id of the child process's parent.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.hostname
      description: The hostname of the computer for the child process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.last_update
      description: The time of the most recently received event for the child process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.children.start
      description: The start time of the child process in remote computer GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.Process.children.process_pid
      description: The pid of the child process.
      type: Number
    - contextPath: CarbonBlackEDR.Process.children.username
      description: The user assosicated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.process_name
      description: The name of the child process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.path
      description: The path of the child process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.parent_pid
      description: The pid of the child process's parent.
      type: Number
    - contextPath: CarbonBlackEDR.Process.children.segment_id
      description: The child process segment id (processes are identified by this segment id and their id).
      type: Date
    - contextPath: CarbonBlackEDR.Process.children.host_type
      description: The host type of the children process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.os_type
      description: The operating system type of the computer for the child process; one of windows, linux, osx.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.child_proc_type
      description: The type of the host associated with the process.
      type: String
    - contextPath: CarbonBlackEDR.Process.children.unique_id
      description: An internal CB process id combining of the child process id and segment id.
      type: String
  - arguments:
    - description: The internal CB process id; this is the id field in search results.
      name: process_id
      required: true
    - description: The maximum amount of segments to be returned. Default is 50.
      name: limit
    description: Gets segment data for a given process.
    name: cb-edr-process-segments-get
    outputs:
    - contextPath: CarbonBlackEDR.ProcessSegments.last_server_update
      description: The last date/time when the server pushed events into this segment.
      type: Date
    - contextPath: CarbonBlackEDR.ProcessSegments.event_counts.filemod
      description: The number of events for filemod event type stored in this segment.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSegments.event_counts.netconn
      description: The number of events for netconn event type stored in this segment.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSegments.event_counts.crossproc
      description: The number of events for crossproc event type stored in this segment.
      type: Number
    - contextPath: CarbonBlackEDR.ProcessSegments.unique_id
      description: The full process ID + segment number associated with this event segment.
      type: String
    - contextPath: CarbonBlackEDR.ProcessSegments.last_update
      description: The last event (represented in sensor date/time) stored in this segment.
      type: Date
  - arguments:
    - auto: PREDEFINED
      description: |-
        Download a zip archive including a sensor installer for Windows, Mac OS X or Linux.

        For Windows- A ZIP archive which includes a signed Windows EXE or MSI sensor installer and settings file
        For Mac OS X- A ZIP archive which includes a signed OSX PKG sensor installer and settings file
        For Linux- A compressed tarball (tar.gz) archive which includes a Linux sensor installer and settings file.
      name: os_type
      predefined:
      - windows_exe
      - windows_msi
      - osx
      - linux
      required: true
    - description: An ID of a group related to sensors.
      name: group_id
      required: true
    description: Download a zip archive including a sensor installer for Windows, Mac OS X or Linux.
    name: cb-edr-sensor-installer-download
  - arguments:
    - default: true
      description: The internal CB process id; this is the id field in search results.
      name: process_id
      required: true
    - description: |-
        The process segment id. This is the segment_id field in search results.
        If this is set to 0, the API will merge all segments in results.
      name: segment_id
      required: true
    - description: |-
        Return events starting with this offset.
        If not provided, offset will be 0 (returns events starting from the beginning).
      name: start
    - description: How many events to fetch.
      name: count
    description: Gets the events for the process with CB process id (process_id) and segment id (segment_id).
    name: cb-edr-process-events-list
    outputs:
    - contextPath: CarbonBlackEDR.Events.process_md5
      description: The MD5 of the executable backing this process.
      type: String
    - contextPath: CarbonBlackEDR.Events.sensor_id
      description: The sensor id of the host this process executed on.
      type: Number
    - contextPath: CarbonBlackEDR.Events.uid
      description: The uid of the event.
      type: String
    - contextPath: CarbonBlackEDR.Events.filtering_known_dlls
      description: Whether known dlls are filtered.
      type: Boolean
    - contextPath: CarbonBlackEDR.Events.modload_count
      description: The count of modules loaded in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.parent_unique_id
      description: The id of the parent process.
      type: String
    - contextPath: CarbonBlackEDR.Events.cmdline
      description: The command line of the process.
      type: String
    - contextPath: CarbonBlackEDR.Events.max_last_update
      description: The time of last update.
      type: Date
    - contextPath: CarbonBlackEDR.Events.min_last_update
      description: The time of last update.
      type: Date
    - contextPath: CarbonBlackEDR.Events.last_update
      description: The time of the last event received from this process, as recorded by the remote host.
      type: Date
    - contextPath: CarbonBlackEDR.Events.id
      description: The internal CB process id of this process.
      type: String
    - contextPath: CarbonBlackEDR.Events.terminated
      description: Whether the event is terminated.
      type: Boolean
    - contextPath: CarbonBlackEDR.Events.crossproc_count
      description: The count of cross process events launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.group
      description: The sensor group the sensor was assigned to.
      type: String
    - contextPath: CarbonBlackEDR.Events.max_last_server_update
      description: Time of server last update.
      type: Date
    - contextPath: CarbonBlackEDR.Events.parent_id
      description: The Carbon Black process id of the parent process.
      type: String
    - contextPath: CarbonBlackEDR.Events.hostname
      description: The hostname of the computer this process executed on.
      type: String
    - contextPath: CarbonBlackEDR.Events.filemod_count
      description: The count of file modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.start
      description: The start time of this process, as recorded by the remote host.
      type: Date
    - contextPath: CarbonBlackEDR.Events.comms_ip
      description: |-
        IP address that the Cb server received the events on. If the endpoint is behind a NAT,
        for example, this will be the external IP of the network the endpoint lives on.
      type: Number
    - contextPath: CarbonBlackEDR.Events.regmod_count
      description: The count of registry modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.interface_ip
      description: The IP address of the network interface(s) on the endpoint that generated the message.
      type: Number
    - contextPath: CarbonBlackEDR.Events.process_pid
      description: The pid of the process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.username
      description: The user assosicated with the event.
      type: String
    - contextPath: CarbonBlackEDR.Events.process_name
      description: The name of this process, e.g., svchost.exe.
      type: String
    - contextPath: CarbonBlackEDR.Events.emet_count
      description: Number of EMET associated with the event.
      type: Number
    - contextPath: CarbonBlackEDR.Events.last_server_update
      description: When the event was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.Events.path
      description: The full path of the executable backing this process, e.g., c:\windows\system32\svchost.exe .
      type: String
    - contextPath: CarbonBlackEDR.Events.netconn_count
      description: The count of network connections in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.parent_pid
      description: The pid of the process's parent.
      type: Number
    - contextPath: CarbonBlackEDR.Events.segment_id
      description: The segment id of this process.
      type: Date
    - contextPath: CarbonBlackEDR.Events.min_last_server_update
      description: When the event was last updated in the server.
      type: Date
    - contextPath: CarbonBlackEDR.Events.host_type
      description: The host type associated with the event.
      type: String
    - contextPath: CarbonBlackEDR.Events.processblock_count
      description: The number of processblock associated with the process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.filemod_complete.operation_type
      description: |-
        The operation type.
        One of Created the file, First wrote to the file, Deleted the file, Last wrote to the file.
      type: String
    - contextPath: CarbonBlackEDR.Events.filemod_complete.event_time
      description: The event time.
      type: Date
    - contextPath: CarbonBlackEDR.Events.filemod_complete.file_path
      description: The file path.
      type: String
    - contextPath: CarbonBlackEDR.Events.filemod_complete.md5_after_last_write
      description: The md5 of the file after the last write.
      type: String
    - contextPath: CarbonBlackEDR.Events.filemod_complete.file_type
      description: |-
        The file type, if known. One of: PE, Elf, UniversalBin, EICAR, OfficeLegacy, OfficeOpenXml,
        Pdf, ArchivePkzip, ArchiveLzh, ArchiveLzw, ArchiveRar, ArchiveTar, Archive7zip.
      type: String
    - contextPath: CarbonBlackEDR.Events.filemod_complete.flagged_as_potential_tamper_attempt
      description: Whether event is flagged as potential tamper attempt.
      type: String
    - contextPath: CarbonBlackEDR.Events.modload_complete.event_time
      description: The event time.
      type: Date
    - contextPath: CarbonBlackEDR.Events.modload_complete.loaded_module_md5
      description: MD5 of the loaded module.
      type: String
    - contextPath: CarbonBlackEDR.Events.modload_complete.loaded_module_full_path
      description: Full path of the loaded module.
      type: String
    - contextPath: CarbonBlackEDR.Events.regmod_complete.operation_type
      description: |-
        The operation type.
        One of Created the file, First wrote to the file, Deleted the file, Last wrote to the file.
      type: String
    - contextPath: CarbonBlackEDR.Events.regmod_complete.event_time
      description: The event time.
      type: Date
    - contextPath: CarbonBlackEDR.Events.regmod_complete.registry_key_path
      description: The registry key path.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.cross-process_access_type
      description: |-
        The type of cross-process access:
        RemoteThread if remote thread creation; ProcessOpen if process handle open with access privileges.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.event_time
      description: The event time.
      type: Date
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.targeted_process_unique_id
      description: The unique_id of the targeted process.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.targeted_process_md5
      description: The md5 of the targeted process.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.targeted_process_path
      description: The path of the targeted process.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.ProcessOpen_sub-type
      description: The sub-type for ProcessOpen.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.requested_access_priviledges
      description: The requested access priviledges.
      type: String
    - contextPath: CarbonBlackEDR.Events.crossproc_complete.flagged_as_potential_tamper_attempt
      description: Whether event is flagged as potential tamper attempt.
      type: String
    - contextPath: CarbonBlackEDR.Events.os_type
      description: The operating system type of the computer for this process.
      type: String
    - contextPath: CarbonBlackEDR.Events.binaries
      description: The binaries associated with the event.
      type: String
    - contextPath: CarbonBlackEDR.Events.childproc_count
      description: The count of child processes launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Events.unique_id
      description: The unique_id of the Event.
      type: String
  - arguments:
    - default: true
      description: The sensor ID to quarantine.
      name: sensor_id
      required: true
    description: Unquarantine the endpoint.
    name: cb-edr-unquarantine-device
  - arguments:
    - default: true
      description: The sensor ID to quarantine.
      name: sensor_id
      required: true
    description: Isolate the endpoint from the network.
    name: cb-edr-quarantine-device
  - arguments:
    - description: The sensor ID.
      name: id
    - description: Returns the sensor registration(s) with specified IP address.
      name: ip
      predefined:
      - ''
    - description: Retruns the sensor registration(s) in the specified sensor group id.
      name: group_id
    - description: 'only returns sensors that have been inactive for less than the specified number of days.'
      name: inactive_filter_days
    - description: Returns the sensor registration(s) with matching hostname.
      name: hostname
    - description: The maximum amount of sensors to be returned.
      name: limit
    description: List the CarbonBlack sensors.
    name: cb-edr-sensors-list
    outputs:
    - contextPath: CarbonBlackEDR.Sensor.systemvolume_total_size
      description: The size, in bytes, of system volume of endpoint on which sensor in installed.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.emet_telemetry_path
      description: The path of emet telemtry associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.os_environment_display_string
      description: Human-readable string of the installed OS.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.emet_version
      description: The emet version associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.emet_dump_flags
      description: The flags of emet dump associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.clock_delta
      description: The clock delta associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.supports_cblr
      description: Whether the sensor supports cblr.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.sensor_uptime
      description: The uptime of the process.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.last_update
      description: When the sensor last updated.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.physical_memory_size
      description: The size in bytes of physical memory.
      type: Date
    - contextPath: CarbonBlackEDR.Sensor.build_id
      description: The sensor version installed on this endpoint. From the /api/builds/ endpoint.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.uptime
      description: Endpoint uptime in seconds.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.is_isolating
      description: Boolean representing sensor-reported isolation status.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.event_log_flush_time
      description: |-
        If event_log_flush_time is set, the server will instruct the sensor to immediately
        send all data before this date, ignoring all other throttling mechansims.
        To force a host current, set this value to a value far in the future.
        When the sensor has finished sending it’s queued data, this value will be null.
      type: Date
    - contextPath: CarbonBlackEDR.Sensor.computer_dns_name
      description: The DNS name of the endpoint on which the sensor is installed.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.emet_report_setting
      description: The report setting of EMET associated with sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.id
      description: The sensor id of this sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.emet_process_count
      description: The number of EMET processes associated with the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.emet_is_gpo
      description: Whther the EMET is gpo.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.power_state
      description: The sensor power state.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.network_isolation_enabled
      description: Boolean representing network isolation request status.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.systemvolume_free_size
      description: The bytes free on the system volume.
      type: Date
    - contextPath: CarbonBlackEDR.Sensor.status
      description: The sensor status.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.num_eventlog_bytes
      description: Number bytes of eventlog.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.sensor_health_message
      description: Human-readable string indicating sensor’s self-reported status.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.build_version_string
      description: Human-readable string of the sensor version.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.computer_sid
      description: Machine SID of this host.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.next_checkin_time
      description: Next expected communication from this computer in server-local time and zone.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.node_id
      description: The node ID associated with the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.cookie
      description: The cookie associated with the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.emet_exploit_action
      description: The EMET exploit action associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.computer_name
      description: NetBIOS name of this computer.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.license_expiration
      description: When the licene of the sensor expires.
      type: Date
    - contextPath: CarbonBlackEDR.Sensor.supports_isolation
      description: Whther sensor supports isolation.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.parity_host_id
      description: The ID of the parity host associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.supports_2nd_gen_modloads
      description: Whether the sensor support modload of 2nd generation.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.network_adapters
      description: A pipe-delimited list list of IP,MAC pairs for each network interface.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.sensor_health_status
      description: self-reported health score, from 0 to 100. Higher numbers are better.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.registration_time
      description: Time this sensor originally registered in server-local time and zone.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.restart_queued
      description: Whether a restart of the sensot is queued.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.notes
      description: The notes associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.num_storefiles_bytes
      description: Number of storefiles bytes associated with the sensor.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.os_environment_id
      description: The ID of the os enviroment of the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.shard_id
      description: The ID of the shard associated with the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.boot_id
      description: A sequential counter of boots since the sensor was installed.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.last_checkin_time
      description: Last communication with this computer in server-local time and zone.
      type: String
    - contextPath: CarbonBlackEDR.Sensor.os_type
      description: The operating system type of the computer.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.group_id
      description: The sensor group id this sensor is assigned to.
      type: Number
    - contextPath: CarbonBlackEDR.Sensor.display
      description: Deprecated.
      type: Boolean
    - contextPath: CarbonBlackEDR.Sensor.uninstall
      description: when set, indicates sensor will be directed to uninstall on next checkin.
      type: Boolean
  - arguments:
    - default: true
      description: Delete a watchlist in Carbon black Response.
      name: id
      required: true
    description: Delete a Watchlist that is specified using ID.
    name: cb-edr-watchlist-delete
  - arguments:
    - default: true
      description: The watchlist ID.
      name: id
      required: true
    - description: The raw Carbon Black query that this watchlist matches.
      name: search_query
    - description: A description of the update.
      name: description
    - description: Whether the watchlist is enabled or not.
      name: enabled
    description: |-
      Updates a Watchlist that is specified using ID.
    name: cb-edr-watchlist-update
  - arguments:
    - default: true
      description: The watchlist ID.
      name: id
      required: true
    - description: Action type specified for the watchlist. Options for action_type are syslog, email and alert.
      name: action_type
      required: true
      auto: PREDEFINED
      predefined:
      - syslog
      - email
      - alert
    - description: Whether the watchlist is enabled or not.
      name: enabled
      required: true
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    description: |-
      Updates a Watchlist action that is specified using ID.
    name: cb-edr-watchlist-update-action
  - arguments:
    - description: Name of the watchlist.
      name: name
      required: true
    - description: The raw Carbon Black query that this watchlist matches.
      name: search_query
      required: true
    - description: A description of the update.
      name: description
    - description: the type of watchlist. Valid values are ‘modules’ and ‘events’ for binary and process watchlists, respectively. Deafult is 'events'.
      name: index_type
    description: Creates a new Watchlist within EDR,.
    name: cb-edr-watchlist-create
    outputs:
    - contextPath: CarbonBlackEDR.Watchlist.id
      description: An ID for the new watchlist.
      type: Number
  - arguments:
    - default: true
      description: The watchlist ID.
      name: id
    - description: The maximum amount of watchlists to be returned.
      name: limit
    description: Retrieve watchlist in Carbon black Response.
    name: cb-edr-watchlists-list
    outputs:
    - contextPath: CarbonBlackEDR.Watchlist.last_hit_count
      description: A count of lifetime watchlist matches.
      type: Number
    - contextPath: CarbonBlackEDR.Watchlist.description
      description: A description of the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.search_query
      description: The raw Carbon Black query that this watchlist matches.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.enabled
      description: Whether the watchlist is enabled.
      type: Boolean
    - contextPath: CarbonBlackEDR.Watchlist.search_timestamp
      description: Time of the search associated with the watchlist.
      type: Date
    - contextPath: CarbonBlackEDR.Watchlist.index_type
      description: |-
        The type of watchlist.
        Valid values are ‘modules’ and ‘events’ for binary and process watchlists, respectively.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.readonly
      description: Whether the watchlist is readonly.
      type: Boolean
    - contextPath: CarbonBlackEDR.Watchlist.total_hits
      description: The number of total hits associated with the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.date_added
      description: The date this watchlist was created on this Enterprise Server.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.group_id
      description: The sensor group id this watchlist is assigned to.
      type: Number
    - contextPath: CarbonBlackEDR.Watchlist.total_tags
      description: The number of total tags associated with the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.id
      description: The id of this watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Watchlist.last_hit
      description: A timestamp of the last time this watchlist triggered a match.
      type: Date
    - contextPath: CarbonBlackEDR.Watchlist.name
      description: The name of this watchlist.
      type: String
  - arguments:
    - description: The banned hash.
      name: md5
      required: true
    - description: Text description of block list.
      name: text
      required: true
    - description: The last time the hash was blocked or prevented from being executed.
      name: last_ban_time
    - description: Total number of blocks on the banned list.
      name: ban_count
    - description: Last hostname to block this hash.
      name: last_ban_host
    description: Prevent execution of a specified md5 hash.
    name: cb-edr-binary-ban
  - arguments:
    - description: The maximum hashs of result to retrieve.
      name: limit
      required: true
    description: |-
      Returns a list of banned hashes.
    name: cb-edr-binary-bans-list
    outputs:
    - contextPath: CarbonBlackEDR.BinaryBan.username
      description: The username who banned the record.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.audit.username
      description: The user assosicated with the binary ban.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.audit.timestamp
      description: The time of the binary ban.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryBan.audit.text
      description: The text assosicated with the binary ban.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.audit.enabled
      description: Whether the binary ban is enabled.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinaryBan.audit.user_id
      description: The user ID assosiated with binary ban.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryBan.text
      description: The text description of banned record.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.md5hash
      description: The banned hash.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.block_count
      description: The total number of blocks on the banned list.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryBan.user_id
      description: The id of the user who banned the record.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryBan.last_block_sensor_id
      description: The last sensor id which prevented the hash from executing.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.enabled
      description: Whether the ban is enabled.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinaryBan.last_block_time
      description: The  last time the hash was blocked or prevented from being executed.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryBan.timestamp
      description: The date and time the record was banned.
      type: String
    - contextPath: CarbonBlackEDR.BinaryBan.last_block_hostname
      description: The last hostname to block this hash.
      type: String
  - arguments:
    - description: Alert unique identifier.
      isArray: true
      name: alert_ids
      required: true
    - description: "The requested status to."
      name: status
      auto: PREDEFINED
      predefined:
      - Resolved
      - Unresolved
      - In Progress
      - False Positive
    - description: Setting is_ignored to True for an Alert carries through to the threat report that generated the Alert. Any further hits on IOCs contained within that report will no longer trigger an Alert.
      name: set_ignored
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Advanced query string. Accepts the same data as the search box on the Process Search page. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided.
      name: query
    description: |-
      Alerts update and resolution.
      Updating Alerts requires an API key with Global Administrator privileges.
    name: cb-edr-alert-update
  - arguments:
    - description: Alert status to filter by.
      name: status
      auto: PREDEFINED
      predefined:
      - Unresolved
      - In Progress
      - Resolved
      - False Positive
    - description: Alert username to filter by.
      name: username
    - description: Alert feedname to filter by.
      name: feedname
    - description: Alert hostname to filter by.
      name: hostname
    - description: Alert report name (watchlist_id) to filter by.
      name: report
    - description: Advanced query string. Accepts the same data as the search box. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided.
      name: query
    - description: Sort rows by this field and order. server_added_timestamp desc by default.
      name: sort
    - description: Return facet results. 'false' by default, set to 'true' for facets.
      name: facet
    - description: Maximum number of alerts to show, 10 by default.
      name: limit
    description: Retrieve alerts from Carbon Black Response.
    name: cb-edr-alert-search
    outputs:
    - contextPath: CarbonBlackEDR.Alert.Terms
      description: A list of strings, each representing a token as parsed by the query parser.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.username
      description: |-
        The user assosicated with the alert.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.alert_type
      description: The type of the alert.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.sensor_criticality
      description: |-
        The criticality of the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.modload_count
      description: The count of modules loaded.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.report_score
      description: |-
        The score of the report.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.watchlist_id
      description: The id of the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.sensor_id
      description: The id of the sensor.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.feed_name
      description: The name of the source feed.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.created_time
      description: The alert creation time.
      type: Date
    - contextPath: CarbonBlackEDR.Alert.Results.report_ignored
      description: Whether the alert report should be ignored.
      type: Boolean
    - contextPath: CarbonBlackEDR.Alert.Results.ioc_type
      description: The type of the resource.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.watchlist_name
      description: The name of the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.ioc_confidence
      description: The confience of the resource.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.ioc_attr
      description: |-
        The resource attributes.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.alert_severity
      description: |-
        The severity of the alert.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.crossproc_count
      description: |-
        The count of cross process events launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.group
      description: The sensor group id this sensor is assigned to.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.hostname
      description: |-
        The hostname assisicated with the alert.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.filemod_count
      description: The count of file modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.comms_ip
      description: |-
        IP address that the Cb server received the alert on. If the endpoint is behind a NAT,
        for example, this will be the external IP of the network the endpoint lives on.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.netconn_count
      description: The count of network connections in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.interface_ip
      description: The IP address of the network interface(s) on the endpoint that generated the message.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.status
      description: The status of the alert. One of Resolved, Unresolved, In Progress, or False Positive.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.process_path
      description: The path of the process.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.description
      description: The description of the alert.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.process_name
      description: |-
        The name of the process.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.process_unique_id
      description: The unique_id of the targeted process.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.process_id
      description: The id of the process.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.link
      description: |-
        A link to the report.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results._version_
      description: |-
        The version of the alert.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.regmod_count
      description: The count of registry modifications in this process.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.md5
      description: The md5 of the process.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.segment_id
      description: |-
        The segment id of the process.
      type: Date
    - contextPath: CarbonBlackEDR.Alert.Results.total_hosts
      description: The number of total host.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.feed_id
      description: The id of the source feed.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.ioc_value
      description: The value of the resource.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.os_type
      description: The operating system type of the computer for this process; one of Windows, Linux, OSX.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.childproc_count
      description: The count of processes launched by this process.
      type: Number
    - contextPath: CarbonBlackEDR.Alert.Results.unique_id
      description: The unique_id of the alert.
      type: String
    - contextPath: CarbonBlackEDR.Alert.Results.feed_rating
      description: The rating of the Source feed.
      type: Number
  - arguments:
    - default: true
      description: The md5 of the binary.
      name: md5
      required: true
    description: Returns the metadata for the binary with the provided md5.
    name: cb-edr-binary-summary
    outputs:
    - contextPath: CarbonBlackEDR.BinaryMetadata.host_count
      description: The number of host for the targeted file.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_result
      description: |-
        Digital signature status.
        One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
        Untrusted Root, or Explicit Distrust.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.observed_filename
      description: A list of strings, one per unique filename this binary has been seen as.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.product_version
      description: |-
        If present, Product version from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_issuer
      description: If signed and present, the issuer name.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.signed
      description: |-
        Digital signature status.
        One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
        Untrusted Root, or Explicit Distrust.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_sign_time
      description: If signed, the timestamp of the signature in GMT.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryMetadata.orig_mod_len
      description: Filesize in bytes.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.is_executable_image
      description: Whether the file is an EXE.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinaryMetadata.is_64bit
      description: Whether the file is x64.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_subject
      description: If signed and present, the subject.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_publisher
      description: If signed and present, the publisher name.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.group
      description: A list of 0 or more sensor groups (by name) in which this binary was observed.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.event_partition_id
      description: The ID of the event partition associated with the binary file.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.file_version
      description: |-
        If present, File version from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.company_name
      description: |-
        If present, Company name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.internal_name
      description: |-
        If present, Internal name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.icon
      description: The icon of the file.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.product_name
      description: |-
        If present, Product name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_result_code
      description: HRESULT_FROM_WIN32 for the result of the digital signature operation via WinVerifyTrust.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.timestamp
      description: The time of the file search.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryMetadata.copied_mod_len
      description: Bytes copied from remote host, if file is > 25MB this will be less than orig_mod_len.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.server_added_timestamp
      description: The first time this binary was received on the server in the server GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryMetadata.facet_id
      description: The id of the facet searched.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.digsig_prog_name
      description: If signed and present, the program name.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.md5
      description: The md5 hash of this binary.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.endpoint
      description: |-
        A list of 0 or more hostname, sensorid tuples on which this binary was observed.
        The | character serves as the delimiter between the hostname and the sensorid.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.watchlists.wid
      description: The wid of the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.watchlists.value
      description: The value of the watchlist.
      type: Date
    - contextPath: CarbonBlackEDR.BinaryMetadata.legal_copyright
      description: |-
        If present, Legal copyright from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.original_filename
      description: |-
        If present, Original filename from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.cb_version
      description: The version of Carbon Black.
      type: Number
    - contextPath: CarbonBlackEDR.BinaryMetadata.os_type
      description: The operating system type of the computer for this process; one of Windows, Linux, OSX.
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.file_desc
      description: |-
        If present, File description from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinaryMetadata.last_seen
      description: The last seen time of the file.
      type: Date
  - arguments:
    - default: true
      description: The md5 hash of the binary.
      name: md5
      required: true
    description: Download the binary with this md5 hash.
    name: cb-edr-binary-download
  - arguments:
    - description: Gets the name of the product this file is distributed with.
      name: product_name
    - description: The md5 hash of this binary.
      name: md5
    - description: Digital signature status.
      name: digital_signature
      auto: PREDEFINED
      predefined:
      - Signed
      - Unsigned
      - Expired
      - Bad Signature
      - Invalid Signature
      - Invalid Chain
      - Untrusted Root
      - Explicit Distrust
    - description: If signed and present, the publisher name.
      name: publisher
    - description: The name of the company that produced the file.
      name: company_name
    - description: |-
        Sensor group this sensor was
        assigned to at the time of process
        execution.
      name: group
    - description: |-
        Hostname of the computer on
        which the process was executed.
      name: hostname
    - description: Sort rows by this field and order. server_added_timestamp desc by default.
      name: sort
    - description: |-
        Full path of the binary at the time
        of collection.
      name: observed_filename
    - description: Advanced query string. Accepts the same data as the search box. For more information on the query syntax see https://developer.carbonblack.com/resources/query_overview.pdf. If not provided, at least one other search field must be provided.
      name: query
    - description: Return facet results. ‘false’ by default, set to ‘true’ for facets.
      name: facet
    - description: facet field name to return. Multiple facet.field parameters can be specified in a query.
      name: facet_field
    - description: Return this many rows, 10 by default.
      name: limit
    - description: Start at this row, 0 by default.
      name: start
    description: Binary search.
    name: cb-edr-binary-search
    outputs:
    - contextPath: CarbonBlackEDR.BinarySearch.terms
      description: A list of strings, each representing a token as parsed by the query parser.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.total_results
      description: The number of matching binaries.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.highlights
      description: A list of highlight objects matching the query string. Format the same as the process event object.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.host_count
      description: The count of unique endpoints which have ever reported this binary.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.original_filename
      description: |-
        If present, Original filename from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.legal_copyright
      description: |-
        If present, Legal copyright from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_result
      description: |-
        Digital signature status.
        One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature, Invalid Chain,
        Untrusted Root, or Explicit Distrust.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.observed_filename
      description: A list of strings, one per unique filename this binary has been seen as.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.product_version
      description: |-
        If present, Product version from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.watchlists.wid
      description: The wid of the watchlist.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.watchlists.value
      description: The value of the watchlist.
      type: Date
    - contextPath: CarbonBlackEDR.BinarySearch.Results.facet_id
      description: The id of the facet searched.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_issuer
      description: If signed and present, the issuer name.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.copied_mod_len
      description: Bytes copied from remote host, if file is > 25MB this will be less than orig_mod_len.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.comments
      description: Comments of the search.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_sign_time
      description: If signed, the timestamp of the signature in GMT.
      type: Date
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_prog_name
      description: If signed and present, the program name.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.orig_mod_len
      description: Filesize in bytes.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.is_executable_image
      description: Whether the file is an EXE.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinarySearch.Results.is_64bit
      description: Whether the file is x64.
      type: Boolean
    - contextPath: CarbonBlackEDR.BinarySearch.Results.md5
      description: The md5 hash of this binary.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_subject
      description: If signed and present, the subject.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_publisher
      description: If signed and present, the publisher name.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.endpoint
      description: |-
        A list of 0 or more hostname, sensorid tuples on which this binary was observed.
        The | character serves as the delimiter between the hostname and the sensorid.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.group
      description: A list of 0 or more sensor groups (by name) in which this binary was observed.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.results.event_partition_id
      description: The ID of the event partition associated with the binary file.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.digsig_result_code
      description: HRESULT_FROM_WIN32 for the result of the digital signature operation via WinVerifyTrust.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.file_version
      description: |-
        If present, File version from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.signed
      description: |-
        Digital signature status: One of Signed, Unsigned, Expired, Bad Signature, Invalid Signature,
        Invalid Chain, Untrusted Root, or Explicit Distrust.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.last_seen
      description: The last seen time of the file.
      type: Date
    - contextPath: CarbonBlackEDR.BinarySearch.Results.company_name
      description: |-
        If present, Company name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.internal_name
      description: |-
        If present, Internal name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.timestamp
      description: Search creation time.
      type: Date
    - contextPath: CarbonBlackEDR.BinarySearch.Results.cb_version
      description: The version of Carbon Black.
      type: Number
    - contextPath: CarbonBlackEDR.BinarySearch.Results.os_type
      description: The operating system type of this binary; one of windows, linux, osx.
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.file_desc
      description: |-
        If present, File description from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.product_name
      description: |-
        If present, Product name from FileVersionInformation. For more information check
        https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
    - contextPath: CarbonBlackEDR.BinarySearch.Results.server_added_timestamp
      description: The first time this binary was received on the server in the server GMT time.
      type: Date
    - contextPath: CarbonBlackEDR.BinarySearch.Results.private_build
      description: If present, Private build from FileVersionInformation. For more information check https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.fileversioninfo?redirectedfrom=MSDN&view=net-5.0
      type: String
  - arguments:
    - description: The sensor ID.
      name: id
    - default: true
      description: Query sensors with specified IP address.
      isArray: true
      name: ip
    - description: Query sensors with matching hostname.
      name: hostname
    description: Display information about the given sensor.
    name: endpoint
    outputs:
    - contextPath: Endpoint.Hostname
      description: The endpoint's hostname.
      type: String
    - contextPath: Endpoint.Relationships.EntityA
      description: The source of the relationship.
      type: string
    - contextPath: Endpoint.Relationships.EntityB
      description: The destination of the relationship.
      type: string
    - contextPath: Endpoint.Relationships.Relationship
      description: The name of the relationship.
      type: string
    - contextPath: Endpoint.Relationships.EntityAType
      description: The type of the source of the relationship.
      type: string
    - contextPath: Endpoint.Relationships.EntityBType
      description: The type of the destination of the relationship.
      type: string
    - contextPath: Endpoint.OS
      description: The endpoint's operation system.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint's IP address.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint's ID.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint's status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint's isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint's MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
    - contextPath: Endpoint.Domain
      description: The endpoint's domain.
      type: String
    - contextPath: Endpoint.DHCPServer
      description: The DHCP server of the endpoint.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The endpoint's operation system version.
      type: String
    - contextPath: Endpoint.BIOSVersion
      description: The endpoint's BIOS version.
      type: String
    - contextPath: Endpoint.Model
      description: The model of the machine or device.
      type: String
    - contextPath: Endpoint.Memory
      description: Memory on this endpoint.
      type: Int
    - contextPath: Endpoint.Processors
      description: The number of processors.
      type: Int
    - contextPath: Endpoint.Processor
      description: The model of the processor.
      type: String
  dockerimage: demisto/python3:3.12.14.12277297
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Carbon Black Edr - Test
fromversion: 5.5.0