CBFindIP
Search Carbon Black for connection to specified IP addresses.
python · Carbon Black Enterprise Response
Source
import demistomock as demisto from CommonServerPython import * """ MAIN FUNCTION """ def main(): t = [] # type: list found = [] ips = argToList(demisto.args()["ip"]) for ip in ips: for e in demisto.executeCommand("cb-get-processes", {"query": "ipaddr:" + ip}): if isError(e): return_error(e["Contents"]) else: found.append(ip) t += e["HumanReadable"] if t: appendContext("found_ips", ",".join(found), dedup=True) demisto.results( { "ContentsFormat": formats["markdown"], "Type": entryTypes["note"], "Contents": e["HumanReadable"], "EntryContext": e["EntryContext"], } ) """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
Search Carbon Black for connection to specified IP addresses.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | carbon-black, endpoint, enhancement |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| ip | CSV list of IP addresses to identify. |
Outputs
| Path | Description | Type |
|---|---|---|
| Process.Path | Process path. | String |
| Process.PID | Process PID. | Number |
| Process.MD5 | Process MD5 hash. | String |
| Process.Hostname | Process hostname. | String |
| Process.Name | Process name. | String |
| Process.CbSegmentID | Carbon Black “segment” where this process instance is stored. Required to fetch additional information for a process. | String |
| Process.CbID | Carbon Black unique ID for this process instance. Required (together with CbSegmentID) to fetch additional information for a process. | String |
| Process.Endpoint | The endpoint of the process. | String |