carbonblackliveresponse

Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).

Endpoint · Carbon Black Enterprise Live Response

Details

IDcarbonblackliveresponse
ProviderBroadcom
CategoryEndpoint
From Version5.0.0
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Overview

Use the VMware Carbon Black EDR (Live Response API) integration (formerly known as Carbon Black Enterprise Live Response) to enable security operators to collect information and take action on remote endpoints in real time.

VMware Carbon Black EDR (Live Response API) Integration is configurable with both VMware Carbon Black EDR (formerly known as Carbon Black Response) and VMware Carbon Black Endpoint Standard (formerly known as Carbon Black Defense).

Use Cases

  • Upload, download, and remove files.
  • Retrieve and remove registry entries.
  • Dump contents of physical memory.
  • Execute and terminate processes.

Playbooks

  • Carbonblackliveresponse playbook
  • Carbon Black Live Response - Wait until command complete
  • Carbon Black Live Response - Create active session
  • Carbon Black Live Response - Download file

Prerequisites

This integration can be used on either VMware Carbon Black EDR (formerly known as Carbon Black Response) or VMware Carbon Black Endpoint Standard (formerly known as Carbon Black Defense).

Carbon Black Live Response

Enable the Live Response API and get an API key. Live Response is disabled by default. If you attempt to use the Live Response integration before enabling it you receive a code 412 error message.

  1. In the /etc/cb/cb.conf file, set CbLREnabled=True, to enable Live Response in your Carbon Black Response server.
  2. Restart the Carbon Black Enterprise services to activate the changes.

Get an API key

Each user in VMware Carbon Black EDR has a personal API key. The API key confers all rights and capabilities assigned to that user to anyone with access to that API key. Therefore, treat your API key as you would your password.

If the API Token is missing or compromised, you can reset the API key to generate a new token and revoke any previous API keys issued to a user.

  1. Log in to the Carbon Black console.
  2. Click the username in the upper right and select Profile info.
  3. Click API Token on the left hand side to reveal your API token. If there is no API token displayed, click Reset to create a new one.

VMware Carbon Black Endpoint Standard

Retrieve an apiKey and connectorId from the Carbon Black environment. 

  1. Navigate to Settings > Connector.
  2. Set up a VMware API Connector. This gives you access to the apiKey and connectorId.

Configure VMware Carbon Black EDR (Live Response API) on Cortex XSOAR

You can set up the integration to work with either VMware Carbon Black EDR or VMware Carbon Black Endpoint Standard.

Set the required fields to suit your instance ONLY.

To set up the integration to work with VMware Carbon Black EDR:

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for carbonblackliveresponse.
  3. Click _Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL: The hostname or IP address and port of the VMware Carbon Black EDR server used.
    • API Token (CB Response): The VMware Carbon Black EDR API token.
  1. Click Test to validate the URLs, token, and connection.

To set up the integration to work with VMware Carbon Black Endpoint Standard:

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for carbonblackliveresponse.
  3. Click _Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL: The hostname or IP address and port of the VMware Carbon Black Endpoint Standard server used.
    • API Token (CB Defense): The VMware Carbon Black Endpoint Standard API token.
    • Connector ID (CB Defense): The VMware Carbon Black Endpoint Standard connector ID.
  1. Click Test to validate the URLs, token, and connection.

 

Using Live Response Integration

Establish a session with the sensor, to enable commands to be sent to an endpoint.

A sensor with an active session will keep an open connection to the Carbon Black server for as long as the session is active. Sessions are kept for a timeout period, and then recycled.

When executing Live response commands, you can either establish a new session with the sensor or execute commands without session management.

Establish a new session with the sensor and execute commands

  • Enables you to execute multiple commands on the endpoint with one continues session. 
  • Faster execution time per command.
  • Requires session management.

Establish a new session with a specified sensor

Create a new session using cb-session-create or cb-session-create-and-wait (for the session data to be returned only once active).
In the data returned you can find the session ID. This ID will be used to execute Live Response commands on the sensor and retrieve session information when needed.
Only one active session per sensor is allowed at a given time.

Execute Live Response commands providing the session ID

For example, !cb-directory-listing path="c:\" session=1234 wait-timeout=120

Command information will be returned once the command status is active or the wait-timeout has expired (in this case, the command status remains as pending).

In the case of timeout, you may inquire command status and retrieve the command data using cb-command-info.

You may run multiple Live Response commands on one running session, but note that each session has a timeout. This is the timeout that a sensor should wait between commands. If no command is issued over this timeout the sensor will quit.
To avoid session timeout:
- Set a longer timeout when creating a new session.
- Run the cb-keepalive command to reset session timeout.

Close the session using the cb-session-close command.

Execute commands without session management

  • Session management is automated.
  • Longer execution time per command.
  1. Execute Live Response commands providing the sensor ID, e.g. !cb-directory-listing path="c:\" sensor=1 wait-timeout=120
    This will automatically establish a new session with the endpoint, execute the command on the sensor and finally close the session.
    Command information will be returned once the command status is active or the wait-timeout has expired (in this case, the command status remains pending).
    In the case of timeout, you may inquire command status and retrieve the command data using cb-command-info.

Known Limitations

Session Limitations
Only one session per sensor is allowed at a given time. An error will occur when trying to open a new session for a sensor with existing active session.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Archive a session: cb-archive
  2. Cancel a pending command: cb-command-cancel
  3. Display information for a command: cb-command-info
  4. Delete a file: cb-file-delete
  5. Download a file: cb-file-get
  6. Get a file's metadata: cb-file-info
  7. Upload a file to the Carbon Black server: cb-file-upload
  8. Keep a session alive: cb-keepalive
  9. List existing command instances for a session: cb-list-commands
  10. List files: cb-list-files
  11. List all sessions: cb-list-sessions
  12. Close a session: cb-session-close
  13. Create a new session: cb-session-create
  14. Create a new session and wait: cb-session-create-and-wait
  15. Get information about a session: cb-session-info
  16. Terminate a process: cb-process-kill
  17. List directories on the endpoint: cb-directory-listing
  18. Run an executable on an endpoint: cb-process-execute
  19. Endpoint memory dump: cb-memdump
  20. Create a command: cb-command-create
  21. Create a command and wait: cb-command-create-and-wait
  22. Terminate a process: cb-terminate-process
  23. Delete a file from an endpoint: cb-file-delete-from-endpoint
  24. Enumerate registry values: cb-registry-get-values
  25. Query for a registry value: cb-registry-query-value
  26. Create a new registry key: cb-registry-create-key
  27. Delete a registry key: cb-registry-delete-key
  28. Delete a registry value: cb-registry-delete-value
  29. Set a registry value: cb-registry-set-value
  30. Get a list of processes running on an endpoint: cb-process-list
  31. Get a file from an endpoint: cb-get-file-from-endpoint
  32. Save a file to an endpoint: cb-push-file-to-endpoint

1. Archive a session

Archives the specified session. If the session has no content the command fails.

Base Command

cb-archive

Input
Parameter Description Required
session Session ID to archive Required
  
Context Output

There is no context output for this command.

Command Example
cb-archive session=3997
Context Example
{
  "EntryID": "56@a8449d77-4188-4270-846a-396c5a20d1ef",
  "Extension": "zip",
  "Info": "zip",
  "MD5": "81e67ceddfa1dd2fa668840ffab869c0",
  "Name": "session-3951-archive.zip",
  "SHA1": "212ee624e5312d6e589018c23b708682499074f3",
  "SHA256": "64ef1bd46694f9da1ddc1820d3e5f32e147945f024ab8808b6daba4c6b9b1d86",
  "SSDeep": "96:+DAlcOC5Ee//Jbv6CAOYfyYbzz10xldoqbcdqcLE:+DucOa5bv6CdYXbzJ0x7oLLE",
  "Size": 3751,
  "Type": "gzip compressed data, was "/tmp/tmpvpb7Nt", last modified: Mon Aug  6 07:41:02 2018, max compression\n"
}
Human Readable Output

image

2. Cancel a pending command

Cancels the specified command. Only pending commands can be canceled.

Base Command

cb-command-cancel

Input
Parameter Description Required
session Session ID of command to cancel Required
command Command ID to cancel Required
 
Context Output

 

Path Description
CbLiveResponse.Commands.Status The command status.
CbLiveResponse.Commands.Hostname The hostname of the host running the command.
CbLiveResponse.Commands.CbSensorID The sensor ID.
CbLiveResponse.Commands.CommandName The command name.
CbLiveResponse.Commands.CbSessionID The session ID.
CbLiveResponse.Commands.CbCommandID The command ID.
CbLiveResponse.Commands.OperandObject  Object argument for the CbLive command.For example, for directory list this is the dir path.Click here for more information about the command objects. 
CbLiveResponse.Commands.CreateTime The command's time of creation.
CbLiveResponse.Commands.CommandCompletionTime

When the command was completed. (0 means the command is still in progress.)
CbLiveResponse.Commands.Result.Desc Result description.
CbLiveResponse.Commands.esult.Type Result type.
CbLiveResponse.Commands.Result.Code Result code.
 
Command Example
!cb-command-cancel command=1 session=348
Context Example
Human Readable Output
 

3. Display information for a command

Displays the information of the specified command.

Base Command

cb-command-info

Input
Parameter Description Required
session Session ID of the command Required
command Command ID Required
 
Context Output

There is no context output for this command.

Command Example
!cb-command-info command=1 session=348
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 348,
            "CommandCompletionTime": 1540228071.195328,
            "CommandName": "process list",
            "CreateTime": 1540228071.098885,
            "OperandObject": null,
            "Process": [
                {
                    "CommandLine": "",
                    "CreateTime": 1535357799,
                    "Parent": 0,
                    "ParentGuid": "00000011-0000-0000-0000-000000000000",
                    "Path": "c:\\windows\\system32\\ntoskrnl.exe",
                    "ProcessGuid": "00000011-0000-0004-01d4-3dde478174d0",
                    "ProcessID": 4,
                    "SecurityIdentifier": "s-1-5-18",
                    "Username": "NT AUTHORITY\\SYSTEM"
                }
            ],
            "Result.Code": 0,
            "Result.Desc": "",
            "Result.Type": "WinHresult",
            "Status": "complete"
        }
    }
}
Human Readable Output

CB Response - List Processes: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 348 1 process list complete 1540228071.098885 1540228071.195328     WinHresult 0

 

CB Response - Processes

Process ID Create Time Process Guid Path Command Line Security Identifier Username Parent Parent Guid
4 1535357799 00000011-0000-0004-01d4-3dde478174d0 c:\windows\system32\ntoskrnl.exe   s-1-5-18 NT AUTHORITY\SYSTEM 0 00000011-0000-0000-0000-000000000000

 

4. Delete a file

Deletes the specified file from the Carbon Black server.

Base Command

cb-file-delete

Input
Parameter Description Required
session Session ID Required
file-id File ID Required
 
Context Output
Path Description
CbLiveResponse.Files.Filename The file name.
CbLiveResponse.Files.Size The file size.
CbLiveResponse.Files.CbFileID

The ID of the file within the Cb Session Storage.

 - use with cb-file-get
CbLiveResponse.Files.Status File status (0 means there is no error).
CbLiveResponse.Files.Delete Whether the file was deleted (Boolean).
 
Command Example
Context Example
Human Readable Output 

5. Download a file

Downloads the specified file from the specified session from the Carbon Black server.

Before executing this command, push the file to the Carbon Black endpoint. use command 7-hyperlink, and the name=get-file argument to do this.

Use cb-command-create with name=get-file to push the file from a path on the endpoint to the Carbon Black server before executing cb-file-get.

Base Command

cb-file-get

Input
Parameter Description Required
session Session ID Required
file-id File ID Required
 
Context Output

There is no context output for this command.

Command Example
Context Example
Human Readable Output
 

6. Get a file's metadata

Returns information about the specified file in a specified session.

Base Command

cb-file-info

Input
Parameter Description Required
session Session ID Required
file-id File ID Optional
 
Context Output
Path Description
CbLiveResponse.Files.Filename The file name.
CbLiveResponse.Files.Size The file size.
CbLiveResponse.Files.CbFileID

The ID of the file within the Carbon Black Session Storage

use with cb-file-get.
CbLiveResponse.Files.Status File status (0 means there is no error).
CbLiveResponse.Files.Delete Whether the file was deleted (Boolean).
 
Command Example
Context Example
Human Readable Output

7. Upload a file to the Carbon Black server

Uploads the specified file to the Carbon Black server.

Use cb-command-create with name=put-file to push the file from Cb server to a path on the endpoint.

Base Command

cb-file-upload

Input
Parameter Description Required
session The ID of the session to upload the attachment file through Required
file-id The entry ID of the attachment file to upload. Required
 
Context Output
Path Description
CbLiveResponse.Files.Filename The File name
CbLiveResponse.Files.Size The file size
CbLiveResponse.Files.CbFileID

The ID of the file within the Carbon Defence Session Storage -

use with cb-file-get.
CbLiveResponse.Files.Status File status (0 means there is no error).
CbLiveResponse.Files.Delete Whether the file was deleted (Boolean).
 
Command Example
Context Example
Human Readable Output

8. Keep a session alive

Keeps the specified session alive so that it does not close due to timeout.

Base Command

cb-keepalive

Input
Parameter Description Required
session The ID of the session to keep alive Required
 
Context Output

There is no context output for this command.

Command Example
Context Example
Human Readable Output

9. List existing command instances in a specified session

Returns a list of the existing command instances and their details for the specified session.

Base Command

cb-list-commands

Input
Parameter Description Required
session The session ID Required
 
Context Output

There is no context output for this command.

Command Example
!cb-list-commands session="3951"
Context Example
{
  "Commands": [
    {
      "CbCommandID": 1,
      "CbSensorID": 13,
      "CbSessionID": 3951,
      "CommandCompletionTime": 1533449964.328933,
      "CommandName": "process list",
      "CreateTime": 1533449963.906452,
      "OperandObject": null,
      "Result": {
        "Code": 0,
        "Desc": "",
        "Type": "WinHresult"
      },
      "Status": "complete"
    },
    {
      "CbCommandID": 2,
      "CbSensorID": 13,
      "CbSessionID": 3951,
      "CommandCompletionTime": 1533450217.730081,
      "CommandName": "process list",
      "CreateTime": 1533450217.214258,
      "OperandObject": null,
      "Result": {
        "Code": 0,
        "Desc": "",
        "Type": "WinHresult"
      },
      "Status": "complete"
    },
    {
      "CbCommandID": 3,
      "CbSensorID": 13,
      "CbSessionID": 3951,
      "CommandCompletionTime": 1533450219.874692,
      "CommandName": "directory list",
      "CreateTime": 1533450219.635134,
      "OperandObject": "C:\\Windows\\CarbonBlack",
      "Result": {
        "Code": 0,
        "Desc": "",
        "Type": "WinHresult"
      },
      "Status": "complete"
    },
    {
      "CbCommandID": 4,
      "CbSensorID": 13,
      "CbSessionID": 3951,
      "CommandCompletionTime": 1533450220.312491,
      "CommandName": "directory list",
      "CreateTime": 1533450220.067548,
      "OperandObject": "C:\\Windows\\CarbonBlack\\*",
      "Result": {
        "Code": 0,
        "Desc": "",
        "Type": "WinHresult"
      },
      "Status": "complete"
    },
    {
      "CbCommandID": 5,
      "CbSensorID": 13,
      "CbSessionID": 3951,
      "CommandCompletionTime": 1533450225.146843,
      "CommandName": "directory list",
      "CreateTime": 1533450224.903408,
      "OperandObject": "C:\\Windows",
      "Result": {
        "Code": 0,
        "Desc": "",
        "Type": "WinHresult"
      },
      "Status": "complete"
    }
  ]
}
Human Readable Output

image

10. List files

Lists files in the given session

Base Command

cb-list-files

Input
Parameter Description Required
session The session ID Required
 
Context Output
Path Description
CbLiveResponse.Files.Filename The file name
CbLiveResponse.Files.Size The file size
CbLiveResponse.Files.CbFileID

The ID of the file within the Carbon Black Session Storage -

use with cb-file-get.
CbLiveResponse.Files.Status File status (0 means there is no error)
CbLiveResponse.Files.Delete Whether the file was deleted (Boolean)
 
Command Example
!cb-list-files session=3951
Context Example
Human Readable Output
 

11. List Carbon Black sessions

Returns a list of the Carbon Black sessions.

Base Command

cb-list-sessions

Input
Parameter Description Required
sensor Sensor ID to filter sessions by. Optional
status

Status to filter by. Valid values are:

  • active
  • pending
  • timeout
  • inactive
  • close
 Optional
 
Context Output
Path Description
CbLiveResponse.Sessions.CbSensorID Sensor ID
CbLiveResponse.Sessions.CbSessionID Session ID
CbLiveResponse.Sessions.Hostname Hostname
CbLiveResponse.Sessions.Status Session status
CbLiveResponse.Sessions.WaitTimeout Sensor wait timeout
CbLiveResponse.Sessions.SessionTimeout Session Timeout
 
Command Example
!cb-list-sessions status=timeout
Context Example
{
  "Sessions": {
    "CbSensorID": 13,
    "CbSessionID": 3951,
    "Hostname": "WIN1",
    "SessionTimeout": 300,
    "Status": "timeout",
    "SupportedCommands": [
      "delete file",
      "put file",
      "reg delete key",
      "directory list",
      "reg create key",
      "get file",
      "reg enum key",
      "reg query value",
      "kill",
      "create process",
      "process list",
      "reg delete value",
      "reg set value",
      "create directory",
      "memdump"
    ],
    "WaitTimeout": 120
  }
}
Human Readable Output

image

12. Close a session

Closes the specified session.

Base Command

cb-session-close

Input
Parameter Description Required
session The ID of the session to close Required
 
Context Output
Path Description
CbLiveResponse.Sessions.Status Session status
CbLiveResponse.Sessions.Hostname Hostname
CbLiveResponse.Sessions.CbSensorID Sensor ID
CbLiveResponse.Sessions.CbSessionID Session ID
CbLiveResponse.Sessions.SessionTimeout Session Timeout
CbLiveResponse.Sessions.WaitTimeout Sensor wait timeout
 
Command Example
!cb-session-close session=3951
Context Example
{
  "CbSensorID": 13,
  "CbSessionID": 3951,
  "Hostname": "WIN1",
  "SessionTimeout": 300,
  "Status": "close",
  "SupportedCommands": [
    "delete file",
    "put file",
    "reg delete key",
    "directory list",
    "reg create key",
    "get file",
    "reg enum key",
    "reg query value",
    "kill",
    "create process",
    "process list",
    "reg delete value",
    "reg set value",
    "create directory",
    "memdump"
  ],
  "WaitTimeout": 120
}
Human Readable Output

image

13. Create a new session

Creates a new Carbon Black session for the specified sensor.

Base Command

cb-session-create

Input
Parameter Description Required
sensor The ID of the sensor to create a session for Required
command-timeout If a command is not be issued before this time, the session closes Optional
keepalive-timeout

If a command is not issued after this specified number of seconds, the device quits.

 Optional
 
Context Output
Path Description
CbLiveResponse.Sessions.Status Session Status
CbLiveResponse.Sessions.Hostname Hostname
CbLiveResponse.Sessions.CbSensorID Sensor ID
CbLiveResponse.Sessions.CbSessionID Session ID
CbLiveResponse.Sessions.SessionTimeout Session Timeout
CbLiveResponse.Sessions.WaitTimeout Sensor wait timeout
 
Command Example
!cb-session-create sensor=13
Context Example
{
"CbSensorID": 13,
"CbSessionID": 3996,
"Hostname": "WIN1",
"SessionTimeout": 300,
"Status": "pending",
"SupportedCommands": [],
"WaitTimeout": 120
}
Human Readable Output

image

14. Create a new session and wait

Creates a new Carbon Black session for the specified sensor and waits for it to be active.

Base Command

cb-session-create-and-wait

Input
Parameter Description Required
sensor The ID of the sensor to create a session for Required
command-timeout If a command is not be issued before this time, the session closes Optional
keepalive-timeout

If the 8 command (keepalive) -hyperlink, is not issued before this time, the session closes.

 Optional
wait-timeout The number of seconds to wait for session to be active Optional
 
Context Output
Path Description
CbLiveResponse.Sessions.Status Session status
CbLiveResponse.Sessions.Hostname Hostname
CbLiveResponse.Sessions.CbSensorID Sensor ID
CbLiveResponse.Sessions.CbSessionID Session ID
CbLiveResponse.Sessions.SessionTimeout Session Timeout
CbLiveResponse.Sessions.WaitTimeout Sensor wait timeout
 
Command Example
!cb-session-create-and-wait sensor=17
Context Example
{
    "CbLiveResponse": {
        "Sessions": {
            "CbSensorID": 17,
            "CbSessionID": 334,
            "Hostname": "WIN-B73RGE9AAIF",
            "SessionTimeout": 300,
            "Status": "active",
            "SupportedCommands": [
                "delete file",
                "put file",
                "reg delete key",
                "directory list",
                "reg create key",
                "get file",
                "reg enum key",
                "reg query value",
                "kill",
                "create process",
                "process list",
                "reg delete value",
                "reg set value",
                "create directory",
                "memdump"
            ],
            "WaitTimeout": 120
        }
    }
}
Human Readable Output

CB Response - Create Session And Wait

Cb Sensor ID Cb Session ID Hostname Status Wait Timeout Session Timeout Supported Commands
17 334 WIN-B73RGE9AAIF active 120 300 delete file,put file,reg delete key,directory list,reg create key,get file,reg enum key,reg query value,kill,create process,process list,reg delete value,reg set value,create directory,memdump

 

15. Get information about a session

Displays information about the specified session.

Base Command

cb-session-info

Input
Parameter Description Required
session The ID of the session ID to get information about Required
 
Context Output
Path Description
CbLiveResponse.Sessions.Status Session status
CbLiveResponse.Sessions.Hostname Hostname
CbLiveResponse.Sessions.CbSensorID Sensor ID
CbLiveResponse.Sessions.CbSessionID Session ID
CbLiveResponse.Sessions.SessionTimeout Session Timeout
CbLiveResponse.Sessions.WaitTimeout Sensor wait timeout
 
Command Example
!cb-session-info session=3997
Context Example
{
"CbSensorID": 13,
"CbSessionID": 3997,
"Hostname": "WIN1",
"SessionTimeout": 300,
"Status": "active",
"SupportedCommands": [
"delete file",
"put file",
"reg delete key",
"directory list",
"reg create key",
"get file",
"reg enum key",
"reg query value",
"kill",
"create process",
"process list",
"reg delete value",
"reg set value",
"create directory",
"memdump"
],
"WaitTimeout": 120
}
Human Readable Output

image

16. Terminate a process

Terminates the specified process on the sensor or endpoint.

Base Command

cb-process-kill

Input
Parameter Description Required
session The session ID Optional
pid The PID of the process to terminate Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from pending to in progress</em/complete) Optional
cancel-on-timeout If the command is still pending after this time, the command is cancelled Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The time the command was completed (0 if not completed)
CbLiveResponse.Commands.OperandObject The process ID
 
Command Example
!cb-process-kill pid=972 sensor=17
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 328,
            "CommandCompletionTime": 1540219865.188614,
            "CommandName": "kill",
            "CreateTime": 1540219865.160948,
            "OperandObject": "972",
            "Result": {
                "Code": 0,
                "Desc": "",
                "Type": "WinHresult"
            },
            "Status": "complete"
        }
    }
}
Human Readable Output

CB Response - Kill Process 972: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 328 1 kill complete 1540219865.160948 1540219865.188614 972   WinHresult 0

 

17. List directories

Returns a list of directories on the endpoint.

Base Command

cb-directory-listing

Input
Parameter Description Required
session The session ID. Optional
path Path for the directory (e.g. "c:\Users\"). Note to end with double backslash. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.DirectoryList.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The time the command was completed (0 if not complete)
CbLiveResponse.Commands.OperandObject the directory listing filter (or path)
CbLiveResponse.Commands.Files.FileAttributes A list of file attributes
CbLiveResponse.Commands.Files.CreateTime Create time in Unix time format
CbLiveResponse.Commands.Files.LastAccessTime Last access time in Unix time format.
CbLiveResponse.Commands.Files.LastWriteTime Last write time in Unix time format.
CbLiveResponse.Commands.Files.FileSize The file size.
CbLiveResponse.Commands.Files.FileName The file name.
 
Command Example
!cb-directory-listing path="c:\Users\All Users\Desktop\" sensor=17
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 332,
            "CommandCompletionTime": 1540220585.720132,
            "CommandName": "directory list",
            "CreateTime": 1540220585.692945,
            "Files": [
                {
                    "AlternativeName": null,
                    "CreateTime": 1377185970,
                    "FileAttributes": [
                        "READONLY",
                        "HIDDEN",
                        "DIRECTORY"
                    ],
                    "FileName": ".",
                    "FileSize": 0,
                    "LastAccessTime": 1534297982,
                    "LastWriteTime": 1534297982
                },
                {
                    "AlternativeName": null,
                    "CreateTime": 1377185970,
                    "FileAttributes": [
                        "READONLY",
                        "HIDDEN",
                        "DIRECTORY"
                    ],
                    "FileName": "..",
                    "FileSize": 0,
                    "LastAccessTime": 1534297982,
                    "LastWriteTime": 1534297982
                },
                {
                    "AlternativeName": null,
                    "CreateTime": 1377185972,
                    "FileAttributes": [
                        "HIDDEN",
                        "SYSTEM",
                        "ARCHIVE"
                    ],
                    "FileName": "desktop.ini",
                    "FileSize": 174,
                    "LastAccessTime": 1377185877,
                    "LastWriteTime": 1377185877
                },
                {
                    "AlternativeName": "GOOGLE~1.LNK",
                    "CreateTime": 1509481395,
                    "FileAttributes": [
                        "ARCHIVE"
                    ],
                    "FileName": "Google Chrome.lnk",
                    "FileSize": 2163,
                    "LastAccessTime": 1509481395,
                    "LastWriteTime": 1533760799
                }
            ],
            "OperandObject": "c:\\Users\\All Users\\Desktop\\",
            "Result": {
                "Code": 0,
                "Desc": "",
                "Type": "WinHresult"
            },
            "Status": "complete"
        }
    }
}
Human Readable Output

CB Response - Directory Listing: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 332 1 directory list complete 1540220585.692945 1540220585.720132 c:\Users\All Users\Desktop| WinHresult 0  

 

CB Response - Directory Listing

File Attributes Create Time Last Access Time Last Write Time File Size File Name Alternative Name
READONLY,HIDDEN,DIRECTORY 1377185970 1534297982 1534297982 0 .  
READONLY,HIDDEN,DIRECTORY 1377185970 1534297982 1534297982 0 ..  
HIDDEN,SYSTEM,ARCHIVE 1377185972 1377185877 1377185877 174 desktop.ini  
ARCHIVE 1509481395 1509481395 1533760799 2163 Google Chrome.lnk GOOGLE~1.LNK

 

18. Run an executable on an endpoint

Runs the executable on an endpoint.

Base Command

cb-process-execute

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path the path and command line of the executable Required
wait An optional parameter to specify whether to wait for the process to complete execution before reporting the result. Optional
working-directory An optional parameter to specify the working directory of the executable. Optional
output-file An option file that STDERR and STDOUT will be redirected to. Optional
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command Status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The path and command line of the executable
CbLiveResponse.Commands.ReturnCode The return code of the process (if wait was set to true)
CbLiveResponse.Commands.ProcessID The PID of the executed process
 
Command Example
Context Example
Human Readable Output

19. Endpoint memory dump

Endpoint memory dump.

Base Command

cb-memdump

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path the path to save the resulting memory dump (on the endpoint). Required
compress An optional parameter to specify whether to compress resulting memory dump. Optional
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command Status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete)
CbLiveResponse.Commands.OperandObject The path to save the resulting memory dump (on the endpoint)
CbLiveResponse.Commands.ReturnCode Return code of the memory dump process
CbLiveResponse.Commands.CompressingEnabled Boolean flag indicating if compression is enabled.
CbLiveResponse.Commands.Complete Boolean flag indicating if memory dump is completed.
CbLiveResponse.Commands.PercentDone Percent of the process completed
CbLiveResponse.Commands.DumpingInProgress Boolean flag indicating if memory dump is in progress.
 
Command Example
!cb-memdump path="c:\Users\All Users\Desktop" sensor=17
Context Example
Human Readable Output

20. Create a live response command

Creates a Carbon Black Live Response command.

Base Command

cb-command-create

Input
Parameter Description Required
name Command name Required
timeout Command timeout Optional
object the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes Optional
compress "true" or "false" - an optional parameter to specify whether to compress resulting memory dump Optional
working-dir An optional parameter to specify the working directory of the executable Optional
output-file An option file that STDERR and STDOUT will be redirected to. Optional
value-data the data associated with the registry value Optional
value-type the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….) Optional
overwrite “true” or “false”. An optional parameter to specify whether to overwrite the value if it already exists (default value is “false”) Optional
offset a byte offset to start getting the file. Supports a partial get. Optional
get-count the number of bytes to grab Optional
session Session ID to create command for Required
 
Context Output
Path Description
CbLiveResponse.Commands.Status The Command Status
CbLiveResponse.Commands.Hostname The hostname running the command
CbLiveResponse.Commands.CbLiveResponse.Commands.CbSensorID The Sensor ID
CbLiveResponse.Commands.CommandName The Command name
CbLiveResponse.Commands.CbSessionID The Session ID
CbLiveResponse.Commands.CbCommandID The Command ID
CbLiveResponse.Commands.OperandObject Object argument for the CbLive command - e.g. for 'directory list' this is the path of the dir to list. For more information, see the Carbon Black documentation.
CbLiveResponse.Commands.CreateTime Command create time
CbLiveResponse.Commands.CommandCompletionTime The time the command completed or 0 if still in progres.
CbLiveResponse.Commands.Result.Desc Result description
CbLiveResponse.Commands.Result.Type Result type
CbLiveResponse.Commands.Result.Code Result code
 
Command Example
!cb-command-create session=337 name="process-list"
!cb-command-create session=337 name="directory-list" object="c:\Users\" (path)
!cb-command-create session=337 name=kill object=1 (pid)
Context Example
Human Readable Output

21. Create a Live Response command and wait

Creates a Live Response command and waits for it to finish executing.

Base Command

cb-command-create-and-wait

Input
Parameter Description Required
name Command name Required
timeout Command timeout Optional
object the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes Optional
compress "true" or "false" - an optional parameter to specify whether to compress resulting memory dump Optional
working-dir An optional parameter to specify the working directory of the executable Optional
output-file An option file that STDERR and STDOUT will be redirected to. Optional
value-data the data associated with the registry value Optional
value-type the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….) Optional
overwrite “true” or “false”. An optional parameter to specify whether to overwrite the value if it already exists (default value is “false”) Optional
offset a byte offset to start getting the file. Supports a partial get. Optional
get-count the number of bytes to grab Optional
session Session ID to create command for Required
wait-timeout Time to wait in seconds to wait for command to finish executing Optional
 
Context Output

There is no context output for this command.

Command Example
!cb-command-create-and-wait session=337 name="process-list"
!cb-command-create-and-wait session=337 name="directory-list" object="c:\Users\" (path)
!cb-command-create-and-wait session=337 name=kill object=1 (pid)
Context Example
Human Readable Output

22. Terminate a process

Terminates the specified process at the sensor endpoint.

Base Command

cb-terminate-process

Input
Parameter Description Required
session Session ID Required
pid The PID of the process to terminate Required
wait-timeout Time to wait in seconds for process to complete termination Optional
 
Context Output

There is no context output for this command.

Command Example
Context Example
Human Readable Output

23. Delete a file from an endpoint

Deletes the specified file from an endpoint.

Base Command

cb-file-delete-from-endpoint

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The source path of the object to delete. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The source path of the object to delete
 
Command Example
!cb-file-delete-from-endpoint sensor="17" path="c:\Users\All Users\Desktop\mooncake.jpg" wait-timeout="20"
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 339,
            "CommandCompletionTime": 1540224791.225669,
            "CommandName": "delete file",
            "CreateTime": 1540224791.197925,
            "OperandObject": "c:\\Users\\All Users\\Desktop\\mooncake.jpg",
            "Result": {
                "Code": 2147942402,
                "Desc": "",
                "Type": "WinHresult"
            },
            "Status": "error"
        }
    }
}
Human Readable Output

CB Response - Delete File From Endpoint: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 339 1 delete file error 1540224791.197925 1540224791.225669 c:\Users\All Users\Desktop\mooncake.jpg   WinHresult 2147942402

 

24. Enumerate registry values

Enumerates the registry values.

Base Command

cb-registry-get-values

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The path of the key to query Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The path of the key to queried
CbLiveResponse.Commands.Values.RegKeyType Registry value type
CbLiveResponse.Commands.Values.RegKeyName The name of the registry value
CbLiveResponse.Commands.Values.RegKeyData The data associated with the registry value
CbLiveResponse.Commands.SubKeys List of subkey names
 
Command Example
Context Example
Human Readable Output

25. Query for a registry value

Query for registry value.

Base Command

cb-registry-query-value

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The path of the key + the path of the value (e.g. HKEY_LOCAL_MACHINE\blah\key\value). Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command identifier.
CbLiveResponse.Commands.CommandName The command name.
CbLiveResponse.Commands.Status The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject the path of the key + the path of the value (ie HKEY_LOCAL_MACHINE\blah\key\value).
CbLiveResponse.Commands.Registry.QueryValue.Values.RegKeyType Registry value type.
CbLiveResponse.Commands.RegKeyName the name of the registry value.
CbLiveResponse.Commands.RegKeyData The data associated with the registry value.
CbLiveResponse.Commands.SubKeys List of subkey names.
 
Command Example
Context Example
Human Readable Output

26. Create a new registry key

Creates a new registry key.

Base Command

cb-registry-create-key

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The key path to create. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete)
CbLiveResponse.Commands.OperandObject The key path
 
Command Example
Context Example
Human Readable Output

27. Delete a registry key

Deletes the specified registry key.

Base Command

cb-registry-delete-key

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The key path to delete. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete)
CbLiveResponse.Commands.OperandObject the key path
 
Command Example
Context Example
Human Readable Output

28. Delete a registry value

Delete registry value.

Base Command

cb-registry-delete-value

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The path of the key + the path of the value. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The key path
 
Command Example
Context Example
Human Readable Output

29. Set a registry value

Sets a registry value.

Base Command

cb-registry-set-value

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The path of the key + the path of the value. Required
data The data to set for the value. Note if the value type ‘REG_MULTI_SZ’ then multiple values should be separated by a comma (e.g. value1, value2, value3). Required
type One of common registry value types (REG_DWORD, REG_QWORD, REG_SZ etc). Required
overwrite An optional parameter to specify whether to overwrite the value if it already exists (default value is ’no’). Optional
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command ID
CbLiveResponse.Commands.CommandName The command name
CbLiveResponse.Commands.Status

The command status

  • pending
  • in progress
  • complete
  • error
  • canceled
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete)
CbLiveResponse.Commands.OperandObject The key path
 
Command Example
Context Example
Human Readable Output

30. Get a list processes running on an endpoint

Returns a list of processes running on the endpoint.

Base Command

cb-process-list

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
cancel-on-timeout Cancel the command if still 'pending' after timeout. Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command identifier.
CbLiveResponse.Commands.CommandName The command name.
CbLiveResponse.Commands.Status The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.Processes.ProcessID Process ID.
CbLiveResponse.Commands.Processes.CreateTime The creation time of the process in Unix time.
CbLiveResponse.Commands.Processes.ProcessGuid The process guid of the process.
CbLiveResponse.Commands.Processes.Path The execution path of the process.
CbLiveResponse.Commands.Processes.SecurityIdentifier The Security Identifier (SID) of the default process token.
CbLiveResponse.Commands.Processes.Username The username of the default process token.
CbLiveResponse.Commands.Processes.Parent The pid (process id ) of the parent.
CbLiveResponse.Commands.Processes.ParentGuid The process guid of the parent process.
 
Command Example
!cb-process-list sensor=1
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 327,
            "CommandCompletionTime": 1540219086.030599,
            "CommandName": "process list",
            "CreateTime": 1540219085.939409,
            "OperandObject": null,
            "Process": [
                {
                    "CommandLine": "",
                    "CreateTime": 1535357799,
                    "Parent": 0,
                    "ParentGuid": "00000011-0000-0000-0000-000000000000",
                    "Path": "c:\\windows\\system32\\ntoskrnl.exe",
                    "ProcessGuid": "00000011-0000-0004-01d4-3dde478174d0",
                    "ProcessID": 4,
                    "SecurityIdentifier": "s-1-5-18",
                    "Username": "NT AUTHORITY\\SYSTEM"
                },
                {
                    "CommandLine": "\\SystemRoot\\System32\\smss.exe",
                    "CreateTime": 1535357799,
                    "Parent": 4,
                    "ParentGuid": "00000011-0000-0004-01d4-3dde478174d0",
                    "Path": "c:\\windows\\system32\\smss.exe",
                    "ProcessGuid": "00000011-0000-0188-01d4-3dde4783d56b",
                    "ProcessID": 392,
                    "SecurityIdentifier": "s-1-5-18",
                    "Username": "NT AUTHORITY\\SYSTEM"
                }
    ]
}
Human Readable Output

CB Response - List Processes: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 327 1 process list complete 1540219085.939409 1540219086.030599     WinHresult 0

 

CB Response - Processes

Process ID Create Time Process Guid Path Command Line Security Identifier Username Parent Parent Guid
4 1535357799 00000011-0000-0004-01d4-3dde478174d0 c:\windows\system32\ntoskrnl.exe   s-1-5-18 NT AUTHORITY\SYSTEM 0 00000011-0000-0000-0000-000000000000

 

31. Get a file from an endpoint

Retrieves a file from a path on the endpoint.

Base Command

cb-get-file-from-endpoint

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
path The source path of the file. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command identifier.
CbLiveResponse.Commands.CommandName The command name.
CbLiveResponse.Commands.Status The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The source path of the file.
CbLiveResponse.Commands.FileID Unique file ID.
CbLiveResponse.File.Size File size.
CbLiveResponse.File.SHA1 File SHA1.
CbLiveResponse.File.SHA256 File SHA256.
CbLiveResponse.File.Name File name.
CbLiveResponse.File.SSDeep File SSDeep.
CbLiveResponse.File.EntryID File EntryID.
CbLiveResponse.File.Info File info.
CbLiveResponse.File.Type File type.
CbLiveResponse.File.MD5 File MD5 hash
CbLiveResponse.File.Extension File extension.
 
Command Example
!cb-get-file-from-endpoint path="c:\Users\All Users\Desktop\mooncake.jpg" sensor=17
Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 2,
            "CbSensorID": 17,
            "CbSessionID": 356,
            "CommandCompletionTime": 1540229207.655335,
            "CommandName": "get file",
            "CreateTime": 1540229207.608662,
            "FileID": 1,
            "OperandObject": "c:\\Users\\All Users\\Desktop\\mooncake.jpg",
            "Result": {
                "Code": 0,
                "Desc": "",
                "Type": "WinHresult"
            },
            "Status": "complete"
        }
    },
    "File": {
        "EntryID": "168@583490",
        "Extension": "jpg",
        "Info": "image/jpeg",
        "MD5": "1fe52b291d16c7f9a6eaf43074024011",
        "Name": "mooncake.jpg",
        "SHA1": "30bd2461d6cee80227bcf557a6fd47922b96263c",
        "SHA256": "a87b0fa1006b301b7ef2259cfa9aed2ff12c15217796b5dd08b36e006a137cd2",
        "SSDeep": "192:pAzQbZ/ujghzcZHcsWw6o6E7ODeADcBwjZ4P:pAzG/ujgh6xCo60ODe3wj8",
        "Size": 11293,
        "Type": "data\n"
    }
}
Human Readable Output

screen shot 2018-10-22 at 20 27 52

32. Save a file to an endpoint

Saves a file to a specific path on an endpoint.

Base Command

cb-push-file-to-endpoint

Input
Parameter Description Required
session The session ID. Optional
sensor The sensor ID. Provided the sensor ID to run the command with a new session. The session will be created and closed automatically. Optional
entry-id The file entry ID. Required
wait-timeout Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete'). Optional
path The destination path of the file. Include file name and type (e.g. "c:\Users\USER\Desktop\log.txt"). Required
 
Context Output
Path Description
CbLiveResponse.Commands.CbCommandID Unique command identifier.
CbLiveResponse.Commands.CommandName The command name.
CbLiveResponse.Commands.Status The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
CbLiveResponse.Commands.CommandCompletionTime The command completion time (0 if not complete).
CbLiveResponse.Commands.OperandObject The destination path of the file.
 
Command Example

!cb-push-file-to-endpoint entry-id=84@583490 path="c:\Users\All Users\Desktop" sensor=17

Context Example
{
    "CbLiveResponse": {
        "Commands": {
            "CbCommandID": 1,
            "CbSensorID": 17,
            "CbSessionID": 338,
            "CommandCompletionTime": 1540224253.942851,
            "CommandName": "put file",
            "CreateTime": 1540224253.915233,
            "OperandObject": "c:\\Users\\All Users\\Desktop",
            "Result": {
                "Code": 2147942405,
                "Desc": "",
                "Type": "WinHresult"
            },
            "Status": "error"
        },
        "Files": {
            "CbFileID": 1,
            "Delete": false,
            "Filename": "mooncake.jpg",
            "Size": 6167,
            "SizeUploaded": 6167,
            "Status": 0
        }
    },
    "File": {
        "EntryID": "84@583490",
        "Extension": "jpg",
        "Info": "image/jpeg",
        "MD5": "e42a08714529d9c78cce07a04d2e5e7c",
        "Name": "mooncake.jpg",
        "SHA1": "d5b5f31018a1d6d51ff1857d3d79cda60ae525ac",
        "SHA256": "769509b39aad9992435bf900dd9c96ac409be154eaae5c52f40393e9a9c2ffb4",
        "SSDeep": "96:dkwEkdwRnxWUfLO//UTDEuDQ/qBIG9ywAPIloeAIVvx7TM01LT9C:9z2JQLGDQkRzoeAIvlRT9C",
        "Size": 6167,
        "Type": "JPEG image data, JFIF standard 1.01\n"
    }
}
Human Readable Output

CB Response - Push File: Command Status

Cb Sensor ID Cb Session ID Cb Command ID Command Name Status Create Time Command Completion Time Operand Object Result Desc Result Type Result Code
17 338 1 put file error 1540224253.915233 1540224253.942851 c:\Users\All Users\Desktop   WinHresult 2147942405

 

CB Response - File Info

Cb File ID Filename Size Size Uploaded Status Delete
1 mooncake.jpg 6167 6167 0 false

Configuration parameters

  • serverurl — Server URL (required)
  • apitoken — API Token (CB Response)
  • credentials_api_token —
  • apikey — API Key (CB Defense)
  • credentials_api_key —
  • connector — Connector ID (CB Defense)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (33)

  • cb-archive

    Archive the given session (If the session has no content it will fail)

  • cb-command-cancel Deprecated

    Cancel the given command. Only pending commands can be canceled.

  • cb-command-create Deprecated

    Create a live response command. Use cb-session-create instead.

  • cb-command-create-and-wait Deprecated

    Create a live response command and wait for it to finish executing

  • cb-command-info

    Display information on command

  • cb-directory-listing

    List directories on the endpoint.

  • cb-file-delete

    Delete a given file in the session from Cb server.

  • cb-file-delete-from-endpoint

    Delete a file from the endpoint.

  • cb-file-get

    Download a file from Cb server in a given session.

  • cb-file-info

    Get file info for a given file in a session

  • cb-file-upload Deprecated

    Uploads the file to the Cb server. Use cb-push-file-to-endpoint instead.

  • cb-get-file-from-endpoint

    Retrieves a file from a path on the endpoint. For large files, set the "download" argument to "false". Verify that the command completed by using the !cb-command-info command. After the command completes, download the file using the !cb-file-get command.

  • cb-keepalive

    Keep the session alive to avoid closing due to timeout

  • cb-list-commands

    List the CarbonBlack existing commands for a given session

  • cb-list-files

    List files in a given session

  • cb-list-sessions

    List the CarbonBlack sessions

  • cb-memdeump Deprecated

    Deprecated - use cb-memdump instead.

  • cb-memdump

    Executes an endpoint memory dump.

  • cb-process-execute

    Run executable on the endpoint.

  • cb-process-kill

    Terminates a process at the sensor/endpoint

  • cb-process-list

    List processes running on the endpoint.

  • cb-push-file-to-endpoint

    Save a file to a specific path on the endpoint.

  • cb-registry-create-key

    Create a new registry key.

  • cb-registry-delete-key

    Delete registry key.

  • cb-registry-delete-value

    Delete registry value.

  • cb-registry-get-values

    Enumerate registry values

  • cb-registry-query-value

    Query for registry value.

  • cb-registry-set-value

    Set registry value.

  • cb-session-close

    Close the given session

  • cb-session-create

    Create a new CarbonBlack session for a given sensor

  • cb-session-create-and-wait

    Create a new CarbonBlack session for a given sensor and wait for it to be active

  • cb-session-info

    Display session info

  • cb-terminate-process Deprecated

    Terminates a process at the sensor/endpoint

Source

Carbonblackliveresponse.js Carbonblackliveresponse.yml Carbonblackliveresponse_description.md
Download History Raw 
commonfields:
  id: carbonblackliveresponse
  version: -1
name: carbonblackliveresponse
display: VMware Carbon Black EDR (Live Response API)
category: Endpoint
provider: Broadcom
description: Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).
configuration:
- display: Server URL
  name: serverurl
  defaultvalue: ""
  type: 0
  required: true
- display: API Token (CB Response)
  name: apitoken
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: API Token (CB Response)
  name: credentials_api_token
  hiddenusername: true
  type: 9
  required: false
- display: API Key (CB Defense)
  name: apikey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: API Key (CB Defense)
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
- display: Connector ID (CB Defense)
  name: connector
  defaultvalue: ""
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: cb-archive
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID to return the archive of.
    description: Archive the given session (If the session has no content it will fail)
  - name: cb-command-cancel
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID of command to cancel.
    - name: command
      required: true
      description: Command ID to cancel.
    outputs:
    - contextPath: CbLiveResponse.Commands.Status
      description: The Command Status.
    - contextPath: CbLiveResponse.Commands.Hostname
      description: The Hostname running the command.
    - contextPath: CbLiveResponse.Commands.CbSensorID
      description: The Sensor ID.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The Command name.
    - contextPath: CbLiveResponse.Commands.CbSessionID
      description: The Session ID.
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: The Command ID.
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: 'Object argument for the CbLive command - e.g. for ''directory list'' this is the path of the dir to list. Full docs: https://github.com/carbonblack/cbapi/tree/master/sensor_apis#command-objects'
    - contextPath: CbLiveResponse.Commands.CreateTime
      description: Command create time.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The time the command completed or 0 if still in progres.
    - contextPath: CbLiveResponse.Commands.Result.Desc
      description: Result description.
    - contextPath: CbLiveResponse.Commands.esult.Type
      description: Result type.
    - contextPath: CbLiveResponse.Commands.Result.Code
      description: Result code.
    description: Cancel the given command. Only pending commands can be canceled.
  - name: cb-command-info
    arguments:
    - name: session
      required: true
      description: Session ID of the command.
    - name: command
      required: true
      description: Command ID.
    description: Display information on command
  - name: cb-file-delete
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    - name: file-id
      required: true
      description: File ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Delete a given file in the session from Cb server.
  - name: cb-file-get
    arguments:
    - name: session
      required: true
      description: Session ID.
    - name: file-id
      required: true
      description: File ID.
    description: Download a file from Cb server in a given session.
    outputs:
    - contextPath: File.Size
      description: File size.
    - contextPath: File.SHA1
      description: File SHA1.
    - contextPath: File.SHA256
      description: File SHA256.
    - contextPath: File.Name
      description: File name.
    - contextPath: File.SSDeep
      description: File SSDeep.
    - contextPath: File.EntryID
      description: File EntryID.
    - contextPath: File.Info
      description: File info.
    - contextPath: File.Type
      description: File type.
    - contextPath: File.MD5
      description: File MD5.
    - contextPath: File.Extension
      description: File extension.
  - name: cb-file-info
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    - name: file-id
      description: File ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Get file info for a given file in a session
  - name: cb-file-upload
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID to upload the file through.
    - name: file-id
      required: true
      description: File entry id of an attachment to upload.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Uploads the file to the Cb server. Use cb-push-file-to-endpoint instead.
  - name: cb-keepalive
    arguments:
    - name: session
      required: true
      default: true
      description: The session ID to keepalive.
    description: Keep the session alive to avoid closing due to timeout
  - name: cb-list-commands
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    description: List the CarbonBlack existing commands for a given session
  - name: cb-list-files
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: List files in a given session
  - name: cb-list-sessions
    arguments:
    - name: sensor
      description: Sensor ID to filter sessions by.
    - name: status
      auto: PREDEFINED
      predefined:
      - active
      - pending
      - timeout
      - inactive
      - close
      description: 'Status to filter by (One of: active, pending, timeout, inactive, close).'
      isArray: true
    outputs:
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    description: List the CarbonBlack sessions
  - name: cb-session-close
    arguments:
    - name: session
      required: true
      description: The session ID to close.
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Close the given session
  - name: cb-session-create
    arguments:
    - name: sensor
      required: true
      default: true
      description: Sensor ID to create session for.
    - name: command-timeout
      description: Session timeout (If a command will not be issued after this time the session will be closed).
    - name: keepalive-timeout
      description: ' the timeout (in seconds) that a device should wait between commands. If no command is issued over this timeout the device will quit.'
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Create a new CarbonBlack session for a given sensor
  - name: cb-session-create-and-wait
    arguments:
    - name: sensor
      required: true
      default: true
      description: Sensor ID to create session for.
    - name: command-timeout
      description: Session timeout (If a command will not be issued after this time the session will be closed).
    - name: keepalive-timeout
      description: Session keepalive timeout (If a keepalive is not issued after this time, the session will close).
    - name: wait-timeout
      description: Time in seconds to wait for session to be active.
      defaultValue: "20"
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Create a new CarbonBlack session for a given sensor and wait for it to be active
  - name: cb-session-info
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID to get info for.
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Display session info
  - name: cb-process-kill
    arguments:
    - name: session
      description: 'Session ID. Provide the session ID to run the command with an existing session. '
    - name: pid
      required: true
      description: Process ID to terminate.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The process ID.
    description: Terminates a process at the sensor/endpoint
  - name: cb-directory-listing
    arguments:
    - name: session
      description: The session ID.
    - name: path
      required: true
      description: Path for the directory (e.g. "c:\\Users\\"). Note to end with double backslash.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.DirectoryList.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the directory listing filter (or path).
    - contextPath: CbLiveResponse.Commands.Files.FileAttributes
      description: List of file attributes.
    - contextPath: CbLiveResponse.Commands.Files.CreateTime
      description: Create time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.LastAccessTime
      description: Last access time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.LastWriteTime
      description: Last write time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.FileSize
      description: The file size.
    - contextPath: CbLiveResponse.Commands.Files.FileName
      description: The file name.
    description: List directories on the endpoint.
  - name: cb-process-execute
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: the path and command line of the executable.
    - name: wait
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: An optional parameter to specify whether to wait for the process to complete execution before reporting the result.
    - name: working-directory
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path and command line of the executable.
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: the return code of the process (if wait was set to “true”).
    - contextPath: CbLiveResponse.Commands.ProcessID
      description: The pid of the executed process.
    description: Run executable on the endpoint.
  - name: cb-memdeump
    deprecated: true
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The full path, including file name, to save the resulting memory dump on the endpoint (example - c:\\temp\\dump_file.dmp).
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path to save the resulting memory dump (on the endpoint).
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: Return code of the memory dump process.
    - contextPath: CbLiveResponse.Commands.CompressingEnabled
      description: Boolean flag indicating if compression is enabled.
    - contextPath: CbLiveResponse.Commands.Complete
      description: Boolean flag indicating if memory dump is completed.
    - contextPath: CbLiveResponse.Commands.PercentDone
      description: Percent of the process completed.
    - contextPath: CbLiveResponse.Commands.DumpingInProgress
      description: Boolean flag indicating if memory dump is in progress.
    description: Deprecated - use cb-memdump instead.
  - name: cb-command-create
    deprecated: true
    arguments:
    - name: name
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - put-file
      - get-file
      - delete-file
      - directory-list
      - reg-enum-key
      - reg-query-value
      - reg-create-key
      - reg-delete-key
      - reg-delete-value
      - reg-set-value
      - process-list
      - kill
      - create-process
      - memdump
      description: Command name.
    - name: timeout
      description: Command timeout.
    - name: object
      description: the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes.
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump ("true" or "false").
    - name: working-dir
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: value-data
      description: the data associated with the registry value.
    - name: value-type
      description: the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….)
    - name: overwrite
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is "false"). Can be "true" or "false".
    - name: offset
      description: a byte offset to start getting the file. Supports a partial get.
    - name: get-count
      description: the number of bytes to grab.
    - name: session
      required: true
      description: Session ID to create command for.
    outputs:
    - contextPath: CbLiveResponse.Commands.Status
      description: The Command Status.
    - contextPath: CbLiveResponse.Commands.Hostname
      description: The Hostname running the command.
    - contextPath: CbLiveResponse.Commands.CbLiveResponse.Commands.CbSensorID
      description: The Sensor ID.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The Command name.
    - contextPath: CbLiveResponse.Commands.CbSessionID
      description: The Session ID.
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: The Command ID.
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: 'Object argument for the CbLive command - e.g. for ''directory list'' this is the path of the dir to list. Full docs: https://github.com/carbonblack/cbapi/tree/master/sensor_apis#command-objects'
    - contextPath: CbLiveResponse.Commands.CreateTime
      description: Command create time.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The time the command completed or 0 if still in progres.
    - contextPath: CbLiveResponse.Commands.Result.Desc
      description: Result description.
    - contextPath: CbLiveResponse.Commands.Result.Type
      description: Result type.
    - contextPath: CbLiveResponse.Commands.Result.Code
      description: Result code.
    description: Create a live response command. Use cb-session-create instead.
  - name: cb-command-create-and-wait
    deprecated: true
    arguments:
    - name: name
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - put-file
      - get-file
      - delete-file
      - directory-list
      - reg-enum-key
      - reg-query-value
      - reg-create-key
      - reg-delete-key
      - reg-delete-value
      - reg-set-value
      - process-list
      - kill
      - create-process
      - memdump
      description: Command name.
    - name: timeout
      description: Command timeout.
    - name: object
      description: the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes.
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump ("true" or "false").
    - name: working-dir
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: value-data
      description: the data associated with the registry value.
    - name: value-type
      description: the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….)
    - name: overwrite
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is "false"). Can be "true" or "false".
    - name: offset
      description: a byte offset to start getting the file. Supports a partial get.
    - name: get-count
      description: the number of bytes to grab.
    - name: session
      required: true
      description: Session ID to create command for.
    - name: wait-timeout
      description: Time to wait in seconds to wait for command to finish executing.
      defaultValue: "20"
    description: Create a live response command and wait for it to finish executing
  - name: cb-terminate-process
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID.
    - name: pid
      required: true
      description: Process ID to terminate.
    - name: wait-timeout
      description: Time to wait in seconds for process to complete termination.
      defaultValue: "20"
    description: Terminates a process at the sensor/endpoint
  - name: cb-file-delete-from-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The source path of the object to delete.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The source path of the object to delete.
    description: Delete a file from the endpoint.
  - name: cb-registry-get-values
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key to query.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path of the key to queried.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyType
      description: Registry value type.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyName
      description: the name of the registry value.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyData
      description: The data associated with the registry value.
    - contextPath: CbLiveResponse.Commands.SubKeys
      description: List of subkey names.
    description: Enumerate registry values
  - name: cb-registry-query-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value (e.g. HKEY_LOCAL_MACHINE\blah\key\value).
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the path of the key + the path of the value (ie HKEY_LOCAL_MACHINE\blah\key\value).
    - contextPath: CbLiveResponse.Commands.Registry.QueryValue.Values.RegKeyType
      description: Registry value type.
    - contextPath: CbLiveResponse.Commands.RegKeyName
      description: the name of the registry value.
    - contextPath: CbLiveResponse.Commands.RegKeyData
      description: The data associated with the registry value.
    - contextPath: CbLiveResponse.Commands.SubKeys
      description: List of subkey names.
    description: Query for registry value.
  - name: cb-registry-create-key
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The key path to create.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Create a new registry key.
  - name: cb-registry-delete-key
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The key path to delete.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the key path.
    description: Delete registry key.
  - name: cb-registry-delete-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Delete registry value.
  - name: cb-registry-set-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value.
    - name: data
      required: true
      description: The data to set for the value. Note if the value type ‘REG_MULTI_SZ’ then multiple values should be separated by a comma (e.g. value1, value2, value3).
    - name: type
      required: true
      description: One of common registry value types (REG_DWORD, REG_QWORD, REG_SZ etc).
    - name: overwrite
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is ’no’).
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Set registry value.
  - name: cb-process-list
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.Processes.ProcessID
      description: Process ID.
    - contextPath: CbLiveResponse.Commands.Processes.CreateTime
      description: The creation time of the process in unix time.
    - contextPath: CbLiveResponse.Commands.Processes.ProcessGuid
      description: The process guid of the process.
    - contextPath: CbLiveResponse.Commands.Processes.Path
      description: The execution path of the process.
    - contextPath: CbLiveResponse.Commands.Processes.SecurityIdentifier
      description: The Security Identifier (SID) of the default process token.
    - contextPath: CbLiveResponse.Commands.Processes.Username
      description: The username of the default process token.
    - contextPath: CbLiveResponse.Commands.Processes.Parent
      description: The pid (process id ) of the parent.
    - contextPath: CbLiveResponse.Commands.Processes.ParentGuid
      description: The process guid of the parent process.
    description: 'List processes running on the endpoint. '
  - name: cb-get-file-from-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The source path of the file.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: download
      description: If "true" will download the file from the CarbonBlack server. Default is "true". Set to false for large files.
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The source path of the file.
    - contextPath: CbLiveResponse.Commands.FileID
      description: Unique file ID.
    - contextPath: CbLiveResponse.File.Size
      description: File size.
    - contextPath: CbLiveResponse.File.SHA1
      description: SHA1 hash.
    - contextPath: CbLiveResponse.File.SHA256
      description: SHA256 hash.
    - contextPath: CbLiveResponse.File.Name
      description: File name.
    - contextPath: CbLiveResponse.File.SSDeep
      description: SSDeep hash.
    - contextPath: CbLiveResponse.File.EntryID
      description: File EntryID.
    - contextPath: CbLiveResponse.File.Info
      description: File info.
    - contextPath: CbLiveResponse.File.Type
      description: File type.
    - contextPath: CbLiveResponse.File.MD5
      description: MD5 hash.
    - contextPath: CbLiveResponse.File.Extension
      description: File extension.
    description: |
      Retrieves a file from a path on the endpoint.
      For large files, set the "download" argument to "false". Verify that the command completed by using the !cb-command-info command.
      After the command completes, download the file using the !cb-file-get command.
  - name: cb-push-file-to-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: entry-id
      required: true
      description: The file entry ID.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: path
      required: true
      description: The destination path of the file. Include file name and type (e.g. "c:\\Users\\USER\\Desktop\\log.txt").
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The destination path of the file.
    description: Save a file to a specific path on the endpoint.
  - name: cb-memdump
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provide the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The full path, including file name, to save the resulting memory dump on the endpoint, for example, c:\\temp\\dump_file.dmp).
    - name: compress
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to compress resulting memory dump. Can be "rue" or "false".
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from "pending" to "in-progress" or "complete").
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Whether to cancel the command if still in "pending" status after timeout. Can be "yes" or "no".
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command status.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path to save the resulting memory dump (on the endpoint).
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: Return code of the memory dump process.
    - contextPath: CbLiveResponse.Commands.CompressingEnabled
      description: Whether compression is enabled.
      type: boolean
    - contextPath: CbLiveResponse.Commands.Complete
      description: Whether the memory dump completed.
      type: boolean
    - contextPath: CbLiveResponse.Commands.PercentDone
      description: Percent of the process completed.
    - contextPath: CbLiveResponse.Commands.DumpingInProgress
      description: Whether the memory dump is in progress.
      type: boolean
    description: Executes an endpoint memory dump.
tests:
- Carbon Black Live Response Test
fromversion: 5.0.0