Block Endpoint - Carbon Black Response V2 Deprecated

Deprecated. Use the `Block Endpoint - Carbon Black Response V2.1` playbook instead. Carbon Black Response - isolates an endpoint for a given hostname.

Carbon Black Enterprise Response · 6 tasks · 2 inputs · 5 outputs

Details

ID	`Block Endpoint - Carbon Black Response V2`
From Version	5.5.0
Tasks	6

README

Deprecated. Use the Block Endpoint - Carbon Black Response V2.1 playbook instead. Carbon Black Response - isolates an endpoint for a given hostname.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CarbonblackV2

Scripts

IsIntegrationAvailable

Commands

cb-quarantine-device
cb-sensor-info

Playbook Inputs

Name	Description	Default Value	Required
Hostname	The hostname to isolate.		Optional
Sensor_id	The sensor ID of the endpoint.		Optional

Playbook Outputs

Path	Description	Type
CbResponse.Sensors.CbSensorID	Carbon Black Response sensor IDs that are isolated.	unknown
Endpoint	The isolated endpoint.	unknown
CbResponse.Sensors.Status	Sensor status.	unknown
CbResponse.Sensors.Isolated	Is sensor isolated.	unknown
Endpoint.Hostname	Endpoint hostname.	unknown

Playbook Image

Block Endpoint - Carbon Black Response V2

Inputs

Hostname — The hostname to isolate.
Sensor_id — The sensor ID of the endpoint.

Outputs

CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors IDs that are isolated.
Endpoint — The isolated endpoint.
CbResponse.Sensors.Status — Sensor status.
CbResponse.Sensors.Isolated — Is sensor isolated.
Endpoint.Hostname — Endpoint hostname.

Commands used

cb-quarantine-device cb-sensor-info

Flowchart

Source

playbook-Block_Endpoint_-_Carbon_Black_Response_V2.yml playbook-Block_Endpoint_-_Carbon_Black_Response_V2.1.yml playbook-Block_Endpoint_-_Carbon_Black_Response_V2.1_README.md

Download History Raw

id: Block Endpoint - Carbon Black Response V2.1
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block Endpoint - Carbon Black Response V2.1
description: Carbon Black Response - isolates an endpoint for a given hostname.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 73040a0e-cca5-4197-8089-f46650317040
    type: start
    task:
      id: 73040a0e-cca5-4197-8089-f46650317040
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4d526596-75df-40b0-82c4-a26ccd094e3e
    type: regular
    task:
      id: 4d526596-75df-40b0-82c4-a26ccd094e3e
      version: -1
      name: Isolate endpoint
      description: Isolate the endpoint from the network.
      script: '|||cb-edr-quarantine-device'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      sensor_id:
        complex:
          root: CarbonBlackEDR.Sensor
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d35be2d6-6709-40d0-846e-dc9aef142e30
    type: title
    task:
      id: d35be2d6-6709-40d0-846e-dc9aef142e30
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: dfca2eb5-d11a-4752-8017-728837c5e97b
    type: condition
    task:
      id: dfca2eb5-d11a-4752-8017-728837c5e97b
      version: -1
      name: Is VMware Carbon Black EDR v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "13"
    scriptarguments:
      brandname:
        simple: VMware Carbon Black EDR v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: d4f20892-a8e1-421a-8df4-99e848ad6cf9
    type: condition
    task:
      id: d4f20892-a8e1-421a-8df4-99e848ad6cf9
      version: -1
      name: 'Is the endpoint ready for isolation? '
      description: |
        Checks if the endpoint is ready for isolation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: CarbonBlackEDR.Sensor
                accessor: is_isolating
            iscontext: true
          right:
            value:
              simple: "false"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ae9cdbc4-5f28-4f30-8f5d-7921ec1a99d7
    type: condition
    task:
      id: ae9cdbc4-5f28-4f30-8f5d-7921ec1a99d7
      version: -1
      name: Is the Hostname or Sensor id defined?
      description: Checks if the hostname or sensor ID is defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
          right:
            value:
              complex:
                root: cbEndpointList
                accessor: computer_name
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Sensor_id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 1b2d65b4-ea00-4f7c-833b-680399f28d5b
    type: regular
    task:
      id: 1b2d65b4-ea00-4f7c-833b-680399f28d5b
      version: -1
      name: Get host information from Carbon Black Enterprise Response
      description: List the Carbon Black sensors.
      script: '|||cb-edr-sensors-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      extend-context:
        simple: cbEndpointList=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: eb40f419-39ad-482a-8365-0a17e203b647
    type: regular
    task:
      id: eb40f419-39ad-482a-8365-0a17e203b647
      version: -1
      name: Set sensor info
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      key:
        simple: CarbonBlackEDR.Sensor
      value:
        complex:
          root: cbEndpointList
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: cbEndpointList.computer_name
                iscontext: true
              right:
                value:
                  simple: inputs.Hostname
                iscontext: true
            - operator: isEqualString
              left:
                value:
                  simple: cbEndpointList.id
                iscontext: true
              right:
                value:
                  simple: inputs.Sensor_id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_4_#default#": 0.13,
      "7_3_yes": 0.51,
      "7_4_#default#": 0.35,
      "8_4_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1425,
        "width": 690,
        "x": -180,
        "y": -140
      }
    }
  }
inputs:
- key: Hostname
  value: {}
  required: false
  description: The hostname to isolate.
  playbookInputQuery:
- key: Sensor_id
  value: {}
  required: false
  description: The sensor ID of the endpoint.
  playbookInputQuery:
outputs:
- contextPath: CarbonBlackEDR.Sensor
  description: The sensor info.
  type: unknown
- contextPath: CarbonBlackEDR.Sensor.systemvolume_total_size
  description: The size, in bytes, of the system volume of the endpoint on which the sensor is installed.
- contextPath: CarbonBlackEDR.Sensor.emet_telemetry_path
  description: The path of the EMET telemetry associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.os_environment_display_string
  description: Human-readable string of the installed OS.
- contextPath: CarbonBlackEDR.Sensor.emet_version
  description: The EMET version associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.emet_dump_flags
  description: The flags of the EMET dump associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.clock_delta
  description: The clock delta associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.supports_cblr
  description: Whether the sensor supports Carbon Black Live Response (CbLR).
- contextPath: CarbonBlackEDR.Sensor.sensor_uptime
  description: The uptime of the process.
- contextPath: CarbonBlackEDR.Sensor.last_update
  description: When the sensor was last updated.
- contextPath: CarbonBlackEDR.Sensor.physical_memory_size
  description: The size in bytes of physical memory.
- contextPath: CarbonBlackEDR.Sensor.build_id
  description: The sensor version installed on this endpoint. From the /api/builds/ endpoint.
- contextPath: CarbonBlackEDR.Sensor.uptime
  description: Endpoint uptime in seconds.
- contextPath: CarbonBlackEDR.Sensor.is_isolating
  description: Boolean representing sensor-reported isolation status.
- contextPath: CarbonBlackEDR.Sensor.event_log_flush_time
  description: |-
    If event_log_flush_time is set, the server will instruct the sensor to immediately
    send all data before this date, ignoring all other throttling mechanisms.
    To force a host current, set this value to a value far in the future.
    When the sensor has finished sending its queued data, this value will be null.
- contextPath: CarbonBlackEDR.Sensor.computer_dns_name
  description: The DNS name of the endpoint on which the sensor is installed.
- contextPath: CarbonBlackEDR.Sensor.emet_report_setting
  description: The report setting of the EMET associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.id
  description: The ID of this sensor.
- contextPath: CarbonBlackEDR.Sensor.emet_process_count
  description: The number of EMET processes associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.emet_is_gpo
  description: Whether the EMET is a GPO.
- contextPath: CarbonBlackEDR.Sensor.power_state
  description: The sensor power state.
- contextPath: CarbonBlackEDR.Sensor.network_isolation_enabled
  description: Boolean representing the network isolation request status.
- contextPath: CarbonBlackEDR.Sensor.systemvolume_free_size
  description: The amount of free bytes on the system volume.
- contextPath: CarbonBlackEDR.Sensor.status
  description: The sensor status.
- contextPath: CarbonBlackEDR.Sensor.num_eventlog_bytes
  description: The number of event log bytes.
- contextPath: CarbonBlackEDR.Sensor.sensor_health_message
  description: Human-readable string indicating the sensor’s self-reported status.
- contextPath: CarbonBlackEDR.Sensor.build_version_string
  description: Human-readable string of the sensor version.
- contextPath: CarbonBlackEDR.Sensor.computer_sid
  description: Machine SID of this host.
- contextPath: CarbonBlackEDR.Sensor.next_checkin_time
  description: Next expected communication from this computer in server-local time and zone.
- contextPath: CarbonBlackEDR.Sensor.node_id
  description: The node ID associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.cookie
  description: The cookie associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.emet_exploit_action
  description: The EMET exploit action associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.computer_name
  description: NetBIOS name of this computer.
- contextPath: CarbonBlackEDR.Sensor.license_expiration
  description: When the license of the sensor expires.
- contextPath: CarbonBlackEDR.Sensor.supports_isolation
  description: Whether the sensor supports isolation.
- contextPath: CarbonBlackEDR.Sensor.parity_host_id
  description: The ID of the parity host associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.supports_2nd_gen_modloads
  description: Whether the sensor support modload of 2nd generation.
- contextPath: CarbonBlackEDR.Sensor.network_adapters
  description: A pipe-delimited list of IP,MAC pairs for each network interface.
- contextPath: CarbonBlackEDR.Sensor.sensor_health_status
  description: Self-reported health score, from 0 to 100. Higher numbers indicate a better health status.
- contextPath: CarbonBlackEDR.Sensor.registration_time
  description: Time this sensor was originally registered in server-local time and zone.
- contextPath: CarbonBlackEDR.Sensor.restart_queued
  description: Whether a restart of the sensor is queued.
- contextPath: CarbonBlackEDR.Sensor.notes
  description: The notes associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.num_storefiles_bytes
  description: Number of storefiles bytes associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.os_environment_id
  description: The ID of the OS environment of the sensor.
- contextPath: CarbonBlackEDR.Sensor.shard_id
  description: The ID of the shard associated with the sensor.
- contextPath: CarbonBlackEDR.Sensor.boot_id
  description: A sequential counter of boots since the sensor was installed.
- contextPath: CarbonBlackEDR.Sensor.last_checkin_time
  description: Last communication with this computer in server-local time and zone.
- contextPath: CarbonBlackEDR.Sensor.os_type
  description: The operating system type of the computer.
- contextPath: CarbonBlackEDR.Sensor.group_id
  description: The sensor group ID this sensor is assigned to.
- contextPath: CarbonBlackEDR.Sensor.uninstall
  description: When set, indicates that the sensor will be directed to uninstall on the next check-in.
tests:
- No tests (auto formatted)
fromversion: 6.8.0