Carbon Black Endpoint Standard

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Category

Endpoint

Pack

CarbonBlackDefense

Configuration parameters

• url — URL (required)
• custom_credentials — Custom Api Key (using for API version 6)
• live_response_credentials — Api Key (Api/Live Response key using for API version 3)
• organization_key — Organization Key
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• isFetch — Fetch incidents
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• suffix_url_path — The type of the alert
• category — The category of the alert.
• device_id — Device id
• policy_id — Policy id
• device_username — Device username
• min_severity — Minimum severity
• query — Query
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
• max_fetch — Maximum number of incidents per fetch

Commands (26)

• cbd-add-rule-to-policy — Adds a new rule to an existing policy. Note: System policies cannot be modified.
• cbd-alerts-search — Gets details on the events that led to an alert. This includes retrieving metadata around the alert as well as the event associated with the alert.
• cbd-create-policy — Creates a new policy on the CB Defense backend.
• cbd-delete-policy — Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.
• cbd-delete-rule-from-policy — Removes a rule from an existing policy. Note: System policies cannot be modified.
• cbd-device-background-scan — Starts a background scan on the device. Not supported for devices in a Linux operating system.
• cbd-device-background-scan-stop — Stops a background scan on the device. Not supported for devices in a Linux operating system.
• cbd-device-bypass — Bypasses a device.
• cbd-device-policy-update — Updates the devices to the specified policy ID.
• cbd-device-quarantine — Quarantines the device. Not supported for devices in a Linux operating system.
• cbd-device-search — Searches devices in your organization.
• cbd-device-unbypass — Unbypasses a device.
• cbd-device-unquarantine — Unquarantines the device. Not supported for devices in a Linux operating system.
• cbd-device-update-sensor-version — Updates the version of a sensor.
• cbd-find-events — Creates an enriched events search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, time_range) is required).
• cbd-find-events-details — Initiates a request to retrieve detail fields for enriched events. the job_id that returns from this command can be used to get the results using the "cbd-find-events-details-results" command.
• cbd-find-events-details-results — Retrieves the status for an enriched events detail request for a given job ID.
• cbd-find-events-results — Retrieves the result for an enriched events search request for a given job ID. By default returns 10 rows.
• cbd-find-processes — Creates a process search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, and time_range) is required.
• cbd-find-processes-results — Retrieves the results of a process search identified by the job ID.
• cbd-get-alert-details — Get details about the events that led to an alert by its ID. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
• cbd-get-policies — Gets the list of policies available in your organization.
• cbd-get-policy — Retrieves a policy object by ID.
• cbd-set-policy — Resets policy fields.
• cbd-update-policy — Updates an existing policy with a new policy. Note: System policies cannot be modified.
• cbd-update-rule-in-policy — Updates an existing rule with a new rule. Note: System policies cannot be modified.