carbonblackliveresponse

Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).

Category

Endpoint

Pack

Carbon_Black_Enterprise_Live_Response

Configuration parameters

• serverurl — Server URL (required)
• apitoken — API Token (CB Response)
• credentials_api_token —
• apikey — API Key (CB Defense)
• credentials_api_key —
• connector — Connector ID (CB Defense)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (33)

• cb-archive — Archive the given session (If the session has no content it will fail)
• cb-command-cancel — Cancel the given command. Only pending commands can be canceled.
• cb-command-create — Create a live response command. Use cb-session-create instead.
• cb-command-create-and-wait — Create a live response command and wait for it to finish executing
• cb-command-info — Display information on command
• cb-directory-listing — List directories on the endpoint.
• cb-file-delete — Delete a given file in the session from Cb server.
• cb-file-delete-from-endpoint — Delete a file from the endpoint.
• cb-file-get — Download a file from Cb server in a given session.
• cb-file-info — Get file info for a given file in a session
• cb-file-upload — Uploads the file to the Cb server. Use cb-push-file-to-endpoint instead.
• cb-get-file-from-endpoint — Retrieves a file from a path on the endpoint. For large files, set the "download" argument to "false". Verify that the command completed by using the !cb-command-info command. After the command completes, download the file using the !cb-file-get command.
• cb-keepalive — Keep the session alive to avoid closing due to timeout
• cb-list-commands — List the CarbonBlack existing commands for a given session
• cb-list-files — List files in a given session
• cb-list-sessions — List the CarbonBlack sessions
• cb-memdeump — Deprecated - use cb-memdump instead.
• cb-memdump — Executes an endpoint memory dump.
• cb-process-execute — Run executable on the endpoint.
• cb-process-kill — Terminates a process at the sensor/endpoint
• cb-process-list — List processes running on the endpoint.
• cb-push-file-to-endpoint — Save a file to a specific path on the endpoint.
• cb-registry-create-key — Create a new registry key.
• cb-registry-delete-key — Delete registry key.
• cb-registry-delete-value — Delete registry value.
• cb-registry-get-values — Enumerate registry values
• cb-registry-query-value — Query for registry value.
• cb-registry-set-value — Set registry value.
• cb-session-close — Close the given session
• cb-session-create — Create a new CarbonBlack session for a given sensor
• cb-session-create-and-wait — Create a new CarbonBlack session for a given sensor and wait for it to be active
• cb-session-info — Display session info
• cb-terminate-process — Terminates a process at the sensor/endpoint