CBFindIP

Search Carbon Black for connection to specified IP addresses.

python · Carbon Black Enterprise Response

Source

import demistomock as demisto
from CommonServerPython import *

""" MAIN FUNCTION """


def main():
    t = []  # type: list
    found = []
    ips = argToList(demisto.args()["ip"])
    for ip in ips:
        for e in demisto.executeCommand("cb-get-processes", {"query": "ipaddr:" + ip}):
            if isError(e):
                return_error(e["Contents"])
            else:
                found.append(ip)
                t += e["HumanReadable"]
    if t:
        appendContext("found_ips", ",".join(found), dedup=True)
        demisto.results(
            {
                "ContentsFormat": formats["markdown"],
                "Type": entryTypes["note"],
                "Contents": e["HumanReadable"],
                "EntryContext": e["EntryContext"],
            }
        )


""" ENTRY POINT """
if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Search Carbon Black for connection to specified IP addresses.

Script Data


Name Description
Script Type python3
Tags carbon-black, endpoint, enhancement
Cortex XSOAR Version 5.0.0

Inputs


Argument Name Description
ip CSV list of IP addresses to identify.

Outputs


Path Description Type
Process.Path Process path. String
Process.PID Process PID. Number
Process.MD5 Process MD5 hash. String
Process.Hostname Process hostname. String
Process.Name Process name. String
Process.CbSegmentID Carbon Black “segment” where this process instance is stored. Required to fetch additional information for a process. String
Process.CbID Carbon Black unique ID for this process instance. Required (together with CbSegmentID) to fetch additional information for a process. String
Process.Endpoint The endpoint of the process. String