Carbon black Protection Rapid IOC Hunting

Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9).

Carbon Black Enterprise Protection · 6 tasks · 0 inputs · 0 outputs

Flowchart

yes yes start_task start_task Search observed hashes in the Bit9 file catalog - CBPCatalogFindHash Search observed hashes in... CBPCatalogFindHash Check if the hashes are included in any Bit9 rules - CBPFindRule Check if the hashes are i... CBPFindRule Is CarbonBlack Protection v2 enabled? - Exists Is CarbonBlack Protection... Exists Done Done Do we have files to hunt? - Exists Do we have files to hunt? Exists