Carbon Black Defense

Deprecated. Use Carbon Black Endpoint Standard instead.

Category

Endpoint

Pack

CarbonBlackDefense

Configuration parameters

• url — Server URL (e.g. https://192.168.0.1) (required)
• key — API Key (required)
• version — API Version (required)
• connectorId — Connector ID (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• siemKey — SIEM key. Use to fetch incidents.
• siemConnector — SIEM Connector ID. Use to fetch incidents.
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (16)

• cbd-add-rule-to-policy — Add a new rule to an existing policy. Please note that system policies cannot be modified.
• cbd-change-device-status — Change status of an individual device by its device ID. The requested security policy can be indicated either as a policy ID (policyId) or policy name (policyName).The current revision of the Cb Defense backend only allows one element to be changed with this call: the security policy assigned to the device. For example policyName=Restrictive_Windows_Workstation
• cbd-create-policy — Create a new Policy on the Cb Defense backend.
• cbd-delete-policy — Delete a policy from the Cb Defense backend. This may return an error if devices are actively assigned to the policy id requested for deletion. Please note that system policies cannot be deleted.
• cbd-delete-rule-from-policy — Removes a rule from an existing policy. Please note that system policies cannot be modified.
• cbd-find-event — Retrieve details for an individual event given the event ID
• cbd-find-events — Retrieves all events matching the input search criteria.
• cbd-find-processes — Find processes associated with a specific indicator or IP address filter. Only API keys of type “API” can call the processes API.
• cbd-get-alert-details — Get details on the events that led to an alert. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
• cbd-get-device-status — Retrieve details for an individual device given the device ID.
• cbd-get-devices-status — Get a status of all devices. Optionally you can include a query parameter to filter the results. Combining these query parameters is an implicit “AND”.
• cbd-get-policies — Get the list of policies available in your organization.
• cbd-get-policy — Retrieve a policy object by ID.
• cbd-set-policy — Re-set policy fields.
• cbd-update-policy — Update an existing policy with a new policy. Please note that system policies cannot be modified.
• cbd-update-rule-in-policy — Update an existing rule with a new rule. Please note that system policies cannot be modified.