CarbonBlackLiveResponseCloud
VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.
- Category
- Endpoint
- Pack
- CarbonBlackDefense
Configuration parameters
- url — Server URL
- custom_key — Custom Key
- custom_id — Custom ID
- credentials_custom_id — Custom ID
- org_key — Organization Key
- credentials_org_key —
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (14)
- cbd-lr-directory-listing — Lists the contents of a directory on the remote machine.
- cbd-lr-execute — Creates a new process on the remote machine with the specified command string.
- cbd-lr-file-delete — Deletes the specified file name on the remote machine.
- cbd-lr-file-get — Retrieves the contents of the specified file on the remote machine.
- cbd-lr-file-put — Creates a new file on the remote machine with the specified data.
- cbd-lr-kill — Terminates a process on the remote machine.
- cbd-lr-memdump — Performs a memory dump operation on the remote machine.
- cbd-lr-ps — Lists the currently running processes on the remote machine.
- cbd-lr-reg-get-values — Enumerates all registry values from the specified registry key on the remote machine. Due to API limitations, binary values will not be shown.
- cbd-lr-reg-key-create — Creates a new registry key on the remote machine.
- cbd-lr-reg-key-delete — Deletes a registry key on the remote machine. The key must be without any subkeys.
- cbd-lr-reg-sub-keys — Enumerates the subkeys of the specified registry key on the remote machine.
- cbd-lr-reg-value-delete — Deletes a registry value on the remote machine.
- cbd-lr-reg-value-set — Sets a registry value on the specified registry key on the remote machine.