carbonblackliveresponse

Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).

Endpoint · Carbon Black Enterprise Live Response

Configuration parameters

  • serverurl — Server URL (required)
  • apitoken — API Token (CB Response)
  • credentials_api_token —
  • apikey — API Key (CB Defense)
  • credentials_api_key —
  • connector — Connector ID (CB Defense)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (33)

  • cb-archive

    Archive the given session (If the session has no content it will fail)

  • cb-command-cancel Deprecated

    Cancel the given command. Only pending commands can be canceled.

  • cb-command-create Deprecated

    Create a live response command. Use cb-session-create instead.

  • cb-command-create-and-wait Deprecated

    Create a live response command and wait for it to finish executing

  • cb-command-info

    Display information on command

  • cb-directory-listing

    List directories on the endpoint.

  • cb-file-delete

    Delete a given file in the session from Cb server.

  • cb-file-delete-from-endpoint

    Delete a file from the endpoint.

  • cb-file-get

    Download a file from Cb server in a given session.

  • cb-file-info

    Get file info for a given file in a session

  • cb-file-upload Deprecated

    Uploads the file to the Cb server. Use cb-push-file-to-endpoint instead.

  • cb-get-file-from-endpoint

    Retrieves a file from a path on the endpoint. For large files, set the "download" argument to "false". Verify that the command completed by using the !cb-command-info command. After the command completes, download the file using the !cb-file-get command.

  • cb-keepalive

    Keep the session alive to avoid closing due to timeout

  • cb-list-commands

    List the CarbonBlack existing commands for a given session

  • cb-list-files

    List files in a given session

  • cb-list-sessions

    List the CarbonBlack sessions

  • cb-memdeump Deprecated

    Deprecated - use cb-memdump instead.

  • cb-memdump

    Executes an endpoint memory dump.

  • cb-process-execute

    Run executable on the endpoint.

  • cb-process-kill

    Terminates a process at the sensor/endpoint

  • cb-process-list

    List processes running on the endpoint.

  • cb-push-file-to-endpoint

    Save a file to a specific path on the endpoint.

  • cb-registry-create-key

    Create a new registry key.

  • cb-registry-delete-key

    Delete registry key.

  • cb-registry-delete-value

    Delete registry value.

  • cb-registry-get-values

    Enumerate registry values

  • cb-registry-query-value

    Query for registry value.

  • cb-registry-set-value

    Set registry value.

  • cb-session-close

    Close the given session

  • cb-session-create

    Create a new CarbonBlack session for a given sensor

  • cb-session-create-and-wait

    Create a new CarbonBlack session for a given sensor and wait for it to be active

  • cb-session-info

    Display session info

  • cb-terminate-process Deprecated

    Terminates a process at the sensor/endpoint