Carbon Black Endpoint Standard (v4.0.19)
Next-generation antivirus + EDR in one cloud-delivered platform that stops commodity malware, advanced malware, non-malware attacks and ransomware.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Default data source
- CarbonBlackEndpointStandardEventCollector
- Categories
- Endpoint
Incident fields (14)
- Carbon Black ES Alert Severity
- Carbon Black ES First Event Time
- Carbon Black ES IOC Hit
- Carbon Black ES IOC Id
- Carbon Black ES Last Event Time
- Carbon Black ES Process Id
- Carbon Black ES Process Name
- Carbon Black ES Report ID
- Carbon Black ES Report Name
- Carbon Black ES Reputation
- Carbon Black ES Target Value
- Carbon Black ES Threat Category
- Carbon Black ES Threat Id
- Carbon Black ES Vector
Integrations (5)
- VMware Carbon Black Endpoint Standard (Deprecated)
- Carbon Black Endpoint Standard v2
- Carbon Black Endpoint Standard v3
- Carbon Black Endpoint Standard Event Collector
- Carbon Black Live Response Cloud
Layouts (1)
- Carbon Black Endpoint Standard Layout
Modeling rules (1)
- VMWare Carbon Black Cloud Modeling Rule
README
Cyber attackers are developing and innovating faster than traditional defenses can withstand. VMware Carbon Black Endpoint Standard (formerly known as Carbon Black Defense) analyzes endpoint data and uncovers malicious activity to stop all types of attacks before they reach critical systems.
What does this pack do?
The Carbon Black Endpoint Standard integration provides commands that enable you to:
- Get details about the events that led to an alert.
- Search devices in your organization.
- Create a process search job.
- Get a list of policies available in your organization.
- Create, delete, and update policies.
- Retrieve detail fields for enriched events.
- Quarantine a device.
- Start a background scan on a device.
This pack includes the following playbooks:
- Carbon Black Defense Find Events: Finds events using a search query.
- Carbon Black Defense Find Event Details: Receives event IDs and returns details about the event.
- Carbon Black Defense Find Processes: Finds processes using a search query.