Block File - Carbon Black Response

This playbook receives an MD5 hash and adds it to the block list in Carbon Black Enterprise Response. Files with that MD5 hash are blocked from execution on the managed endpoints. If the hash is already on the block list, no action is taken on the MD5. The playbook uses the integration ''VMware Carbon Black EDR v2".

Carbon Black Enterprise Response · 5 tasks · 2 inputs · 3 outputs

Inputs

  • MD5 — The MD5 hash of the file you want to block.
  • Text — Text description of block list.

Outputs

  • CbResponse.BlockedHashes.LastBlock.Time — Last block time
  • CbResponse.BlockedHashes.LastBlock.Hostname — Last block hostname
  • CbResponse.BlockedHashes.LastBlock.CbSensorID — Last block sensor ID

Commands used

cb-edr-binary-ban

Flowchart

yes yes Start Start Get a list of blacklisted hashes - cb-edr-binary-ban Get a list of blacklisted... cb-edr-binary-ban Is Carbon Black Enterprise Response enabled? Is Carbon Black Enterpris... Is there an MD5 to block? Is there an MD5 to block? Done Done