import demistomock as demisto
from CommonServerPython import *
""" MAIN FUNCTION """
def main():
t = [] # type: list
found = []
ips = argToList(demisto.args()["ip"])
for ip in ips:
for e in demisto.executeCommand("cb-get-processes", {"query": "ipaddr:" + ip}):
if isError(e):
return_error(e["Contents"])
else:
found.append(ip)
t += e["HumanReadable"]
if t:
appendContext("found_ips", ",".join(found), dedup=True)
demisto.results(
{
"ContentsFormat": formats["markdown"],
"Type": entryTypes["note"],
"Contents": e["HumanReadable"],
"EntryContext": e["EntryContext"],
}
)
""" ENTRY POINT """
if __name__ in ("__main__", "__builtin__", "builtins"):
main()
README
Search Carbon Black for connection to specified IP addresses.
Script Data
Name
Description
Script Type
python3
Tags
carbon-black, endpoint, enhancement
Cortex XSOAR Version
5.0.0
Inputs
Argument Name
Description
ip
CSV list of IP addresses to identify.
Outputs
Path
Description
Type
Process.Path
Process path.
String
Process.PID
Process PID.
Number
Process.MD5
Process MD5 hash.
String
Process.Hostname
Process hostname.
String
Process.Name
Process name.
String
Process.CbSegmentID
Carbon Black “segment” where this process instance is stored. Required to fetch additional information for a process.
String
Process.CbID
Carbon Black unique ID for this process instance. Required (together with CbSegmentID) to fetch additional information for a process.