category: Endpoint
sectionorder:
- Connect
- Collect
provider: Broadcom
commonfields:
  id: Carbon Black Endpoint Standard
  version: -1
configuration:
- defaultvalue: https://defense.conferdeploy.net/
  display: URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Custom Api Key (using for API version 6)
  name: custom_credentials
  type: 9
  required: false
  section: Connect
- display: Api Key (Api/Live Response key using for API version 3)
  name: live_response_credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: The organization unique key. This is required for all use cases (and for fetching incidents) except the policy use cases.
  display: Organization Key
  name: organization_key
  type: 0
  required: false
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Type of alert to be fetched.
  defaultvalue: all
  display: The type of the alert
  name: suffix_url_path
  options:
  - all
  - cbanalytics
  - devicecontrol
  type: 15
  required: false
  section: Connect
- additionalinfo: Category of alert to be fetched (THREAT, MONITORED). If nothing is selected he is fetching from all categories.
  display: The category of the alert.
  name: category
  options:
  - THREAT
  - MONITORED
  type: 16
  required: false
  section: Collect
- additionalinfo: The alerts related to a specific device, represented by its ID.
  display: Device id
  name: device_id
  type: 0
  required: false
  section: Collect
- additionalinfo: The alerts related to a specific policy, represented by its ID.
  display: Policy id
  name: policy_id
  type: 0
  required: false
  section: Collect
- additionalinfo: The alerts related to a specific device, represented by its username.
  display: Device username
  name: device_username
  type: 0
  required: false
  section: Collect
- additionalinfo: The minimum severity of the alerts to be fetched.
  display: Minimum severity
  name: min_severity
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  type: 15
  required: false
  section: Collect
- additionalinfo: Query in Lucene syntax and/or value searches. If defined, the other fetch incidents parameters should be left blank.
  display: Query
  name: query
  type: 0
  required: false
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
description: Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.
display: Carbon Black Endpoint Standard v2
name: Carbon Black Endpoint Standard
script:
  commands:
  - arguments:
    - description: The ID of the alert.
      name: alertId
      required: true
    description: Get details about the events that led to an alert by its ID. This includes retrieving metadata around the alert as well as a list of all the events associated with the alert. Only API keys of type “API” can call the alerts API.
    name: cbd-get-alert-details
    outputs:
    - contextPath: CarbonBlackDefense.Alert.id
      description: The identifier for the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.legacy_alert_id
      description: The unique short ID for the alerts to support easier consumption in the UI console. Use the ID for API requests.
      type: String
    - contextPath: CarbonBlackDefense.Alert.org_key
      description: The unique identifier for the organization associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.create_time
      description: The time the alert was created.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.last_update_time
      description: The last time the alert was updated.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.first_event_time
      description: The time of the first event associated with the alert.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.last_event_time
      description: The time of the latest event associated with the alert.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.threat_id
      description: The identifier of the threat that this alert belongs to. Threats are comprised of a combination of factors that can be repeated across devices.
      type: String
    - contextPath: CarbonBlackDefense.Alert.severity
      description: The threat ranking of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.category
      description: The category of the alert (THREAT, MONITORED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_id
      description: The identifier assigned by Carbon Black Cloud to the device associated with the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.device_os
      description: The operating system of the device associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_os_version
      description: The operating system and version on the device.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_name
      description: The hostname of the device associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_username
      description: The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Alert.policy_id
      description: The identifier for the policy associated with the device at the time of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.policy_name
      description: The name of the policy associated with the device at the time of the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.target_value
      description: The priority of the device assigned by the policy.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.state
      description: The state of the tracking system for alerts as they are triaged and resolved. The state can be OPEN or DISMISSED.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.remediation
      description: The state of the workflow of the tracking system for alerts as they are triaged and resolved. The state can be OPEN or DISMISSED.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.last_update_time
      description: The last time the alert was updated.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.workflow.comment
      description: The comment about the workflow of the tracking system for alerts as they are triaged and resolved.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.changed_by
      description: The name of the person who changed the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.notes_present
      description: Indicates if notes are associated with the threat ID.
      type: Boolean
    - contextPath: CarbonBlackDefense.Alert.tags
      description: Tags associated with the alert ([ "tag1", "tag2" ]).
      type: Unknown
    - contextPath: CarbonBlackDefense.Alert.reason
      description: The description of the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.count
      description: The count of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.report_id
      description: The identifier of the report that contains the IOC.
      type: String
    - contextPath: CarbonBlackDefense.Alert.report_name
      description: The name of the report that contains the IOC.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_id
      description: The identifier of the IOC that caused the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_field
      description: The indicator of comprise (IOC) field that the hit contains.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_hit
      description: IOC field value or IOC that matches the query.
      type: String
    - contextPath: CarbonBlackDefense.Alert.watchlists.id
      description: The ID of the watchlists associated with an alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.watchlists.name
      description: The name of the watchlists associated with an alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.process_guid
      description: The global unique identifier of the process that triggered the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.process_name
      description: The name of the process that triggered the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.run_state
      description: The run state for the watchlist alerts. This value is always "RAN".
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.process_name
      description: The name of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.sha256
      description: The SHA-256 hash of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.ttps
      description: The tactics, techniques, and procedures (TTPs) of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_sha256
      description: The SHA-256 hash of the threat cause actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_md5
      description: The MD5 hash of the threat cause actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_name
      description: Process name or IP address of the threat actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_reputation
      description: The reputation of the threat cause. (KNOWN_MALWARE, SUSPECT_MALWARE, PUP, NOT_LISTED, ADAPTIVE_WHITE_LIST, COMMON_WHITE_LIST, TRUSTED_WHITE_LIST, COMPANY_BLACK_LIST).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_threat_category
      description: The category of the threat cause. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_vector
      description: The source of the threat cause. (EMAIL, WEB, GENERIC_SERVER, GENERIC_CLIENT, REMOTE_DRIVE, REMOVABLE_MEDIA, UNKNOWN, APP_STORE, THIRD_PARTY).
      type: String
    - contextPath: CarbonBlackDefense.Alert.document_guid
      description: The document GUID.
      type: String
    - contextPath: CarbonBlackDefense.Alert.type
      description: The type of alert. (CB_ANALYTICS, DEVICE_CONTROL).
      type: String
    - contextPath: CarbonBlackDefense.Alert.reason_code
      description: The shorthand enum for the full-text reason.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_location
      description: Whether the device was on-premise or off-premise when the alert started. (ONSITE, OFFSITE, UNKNOWN).
      type: String
    - contextPath: CarbonBlackDefense.Alert.created_by_event_id
      description: Event identifier that initiated the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_dlp
      description: Whether the alert involved data loss prevention (DLP). (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_phish
      description: Whether the alert involved phishing. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_c2
      description: Whether the alert involved a command and control (c2) server. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_process_pid
      description: The process identifier (PID) of the actor process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_process_guid
      description: The GUID of the process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_parent_guid
      description: The parent GUID of the process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_cause_event_id
      description: The threat cause cause event ID.
      type: String
    - contextPath: CarbonBlackDefense.Alert.blocked_threat_category
      description: The category of the threat on which we were able to take action. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.not_blocked_threat_category
      description: Other potentially malicious activity involved in the threat on which we weren’t able to take action (either due to policy config, or not having a relevant rule). (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.kill_chain_status
      description: The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. (RECONNAISSANCE, WEAPONIZE, DELIVER_EXPLOIT, INSTALL_RUN, COMMAND_AND_CONTROL, EXECUTE_GOAL, BREACH). For example [ "EXECUTE_GOAL", "BREACH" ].
      type: String
    - contextPath: CarbonBlackDefense.Alert.sensor_action
      description: The action taken by the sensor, according to the rule of the policy. (POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY).
      type: String
    - contextPath: CarbonBlackDefense.Alert.policy_applied
      description: Whether a policy was applied. (APPLIED, NOT_APPLIED).
      type: String
  - arguments:
    - description: The identifier for the device.
      name: device_id
    - auto: PREDEFINED
      description: 'The operating system. Possible values: "WINDOWS", "MAC", "LINUX", and "OTHER".'
      name: os
      predefined:
      - WINDOWS
      - MAC
      - LINUX
      - OTHER
    - auto: PREDEFINED
      description: 'The status of the device. Possible values: "PENDING", "REGISTERED", "DEREGISTERED", "BYPASS", "ACTIVE", "INACTIVE", "ERROR", "ALL", "BYPASS_ON", "LIVE", "SENSOR_PENDING_UPDATE".'
      name: status
      predefined:
      - PENDING
      - REGISTERED
      - DEREGISTERED
      - BYPASS
      - ACTIVE
      - INACTIVE
      - ERROR
      - ALL
      - BYPASS_ON
      - LIVE
      - SENSOR_PENDING_UPDATE
    - description: 'The time to start getting results. specified as ISO-8601 strings for example: "2021-01-27T12:43:26.243Z".'
      name: start_time
    - auto: PREDEFINED
      description: 'The “Target value” configured in the policy assigned to the sensor. Possible values: "LOW", "MEDIUM", "HIGH", "MISSION_CRITICAL".'
      name: target_priority
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - MISSION_CRITICAL
    - description: The query in Lucene syntax and/or value searches.
      name: query
    - description: 'The time to stop getting results. specified as ISO-8601 strings for example: "2021-02-27T12:43:26.243Z".'
      name: end_time
    - defaultValue: '20'
      description: The maximum number of rows to return. Default is 20.
      name: rows
    description: Searches devices in your organization.
    name: cbd-device-search
    outputs:
    - contextPath: CarbonBlackDefense.Device.activation_code
      description: The device activation code to register the sensor with a specific organization.
      type: String
    - contextPath: CarbonBlackDefense.Device.activation_code_expiry_time
      description: The time when the activation code expires and cannot be used to register a device. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.ad_group_id
      description: The Active Directory group ID to match.
      type: Number
    - contextPath: CarbonBlackDefense.Device.appliance_name
      description: The name of the appliance the Virtual Machine (VM) is associated with.
      type: String
    - contextPath: CarbonBlackDefense.Device.appliance_uuid
      description: The UUID of the appliance the VM is associated with.
      type: String
    - contextPath: CarbonBlackDefense.Device.av_ave_version
      description: The AVE version (part of AV Version).
      type: String
    - contextPath: CarbonBlackDefense.Device.av_engine
      description: The current antivirus (AV) version.
      type: String
    - contextPath: CarbonBlackDefense.Device.av_last_scan_time
      description: The last time a local scan completed. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.av_master
      description: Whether the device is an AV Master.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.av_pack_version
      description: The pack version (part of AV version).
      type: String
    - contextPath: CarbonBlackDefense.Device.av_product_version
      description: The product version (part of AV version).
      type: String
    - contextPath: CarbonBlackDefense.Device.av_status
      description: The status of the local scan. For example [ "AV_ACTIVE", "AV_REGISTERED" ]. (AV_NOT_REGISTERED, AV_REGISTERED, AV_DEREGISTERED, AV_ACTIVE, AV_BYPASS, SIGNATURE_UPDATE_DISABLED, ONACCESS_SCAN_DISABLED, ONDEMAND_SCAN_DISABLED, PRODUCT_UPDATE_DISABLED).
      type: String
    - contextPath: CarbonBlackDefense.Device.av_update_servers
      description: A list of the device’s AV servers. For example [ "string", "string" ].
      type: Unknown
    - contextPath: CarbonBlackDefense.Device.av_vdf_version
      description: VDF version (part of AV version).
      type: String
    - contextPath: CarbonBlackDefense.Device.cluster_name
      description: Name of the cluster. A cluster is a group of hosts.
      type: String
    - contextPath: CarbonBlackDefense.Device.current_sensor_policy_name
      description: The name of the policy currently configured on the sensor.
      type: String
    - contextPath: CarbonBlackDefense.Device.datacenter_name
      description: The name of the underlying data center. The data center managed object provides the interface to the common container object for hosts, virtual machines, networks, and datastores.
      type: String
    - contextPath: CarbonBlackDefense.Device.deployment_type
      description: The device’s deployment type. This is a classification that is determined by its lifecycle management policy. (ENDPOINT, WORKLOAD).
      type: String
    - contextPath: CarbonBlackDefense.Device.deregistered_time
      description: The time when the deregister request was received. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.key_name
      description: The key name that describes the device.
      type: String
    - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.key_value
      description: The key value that describes the device.
      type: String
    - contextPath: CarbonBlackDefense.Device.device_meta_data_item_list.position
      description: The position that describes the device.
      type: Number
    - contextPath: CarbonBlackDefense.Device.device_owner_id
      description: The identifier for the device owner associated with the device.
      type: Number
    - contextPath: CarbonBlackDefense.Device.email
      description: The email address for the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Device.encoded_activation_code
      description: The encoded activation code.
      type: String
    - contextPath: CarbonBlackDefense.Device.esx_host_name
      description: The name of the ESX host on which the VM is deployed.
      type: String
    - contextPath: CarbonBlackDefense.Device.esx_host_uuid
      description: The UUID of the ESX host on which the VM is deployed.
      type: String
    - contextPath: CarbonBlackDefense.Device.first_name
      description: The first name of the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Device.id
      description: The ID of the device.
      type: Number
    - contextPath: CarbonBlackDefense.Device.last_contact_time
      description: The last time the sensor contacted Carbon Black Cloud. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_device_policy_changed_time
      description: The last time the sensor changed from one policy to another. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_device_policy_requested_time
      description: The last time the sensor checked for changes to the policy. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_external_ip_address
      description: The last IP address of the device according to Carbon Black Cloud. This can differ from the last_internal_ip_address due to the network proxy or NAT. Can be either IPv4 or IPv6 format.
      type: String
    - contextPath: CarbonBlackDefense.Device.last_internal_ip_address
      description: The last IP address of the device reported by the sensor. Can be either IPv4 or IPv6 format.
      type: String
    - contextPath: CarbonBlackDefense.Device.last_location
      description: The device’s current location relative to the organization’s network, based on the current IP address and the device’s registered DNS domain suffix. (UNKNOWN, ONSITE, OFFSITE).
      type: String
    - contextPath: CarbonBlackDefense.Device.last_name
      description: The last name of the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Device.last_policy_updated_time
      description: The last time the current policy received an update. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_reported_time
      description: The last time Carbon Black Cloud received one or more events reported by the sensor. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_reset_time
      description: The last time the device was reset. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.last_shutdown_time
      description: The last time the device was shutdown. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.linux_kernel_version
      description: Not implemented.
      type: String
    - contextPath: CarbonBlackDefense.Device.login_user_name
      description: The last user who logged in to the device. (Requires Windows Carbon Black Cloud sensor).
      type: String
    - contextPath: CarbonBlackDefense.Device.mac_address
      description: The media access control (MAC) address for the device’s primary interface. (Requires Windows CBC sensor version 3.6.0.1941 or later, or macOS CBC sensor).
      type: String
    - contextPath: CarbonBlackDefense.Device.middle_name
      description: The middle name of the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Device.name
      description: The hostname of the endpoint recorded by the sensor when last initialized.
      type: String
    - contextPath: CarbonBlackDefense.Device.organization_id
      description: The organization identifier.
      type: Number
    - contextPath: CarbonBlackDefense.Device.organization_name
      description: The organization name.
      type: String
    - contextPath: CarbonBlackDefense.Device.os
      description: The operating system. (WINDOWS, MAC, LINUX, OTHER).
      type: String
    - contextPath: CarbonBlackDefense.Device.os_version
      description: The operating system and version of the endpoint.
      type: String
    - contextPath: CarbonBlackDefense.Device.passive_mode
      description: Whether the device is in bypass mode.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.policy_id
      description: The policy identifier assigned to the device.
      type: Number
    - contextPath: CarbonBlackDefense.Device.policy_name
      description: The policy name assigned to the device. This name may not match the current_sensor_policy_name until the sensor checks back in.
      type: String
    - contextPath: CarbonBlackDefense.Device.policy_override
      description: Whether the policy was manually assigned to override mass sensor management.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.quarantined
      description: The indicator that the device is in quarantine mode.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.registered_time
      description: The time when the device was registered with Carbon Black Cloud. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.scan_last_action_time
      description: The last time the background scan was started or stopped. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.scan_last_complete_time
      description: The time the last background scan completed. (ISO 8601 timestamp in UTC).
      type: Date
    - contextPath: CarbonBlackDefense.Device.scan_status
      description: The status of the background scan. (NEVER_RUN, STOPPED, IN_PROGRESS, COMPLETED).
      type: String
    - contextPath: CarbonBlackDefense.Device.sensor_kit_type
      description: The type of sensor installed on the device. (XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX).
      type: String
    - contextPath: CarbonBlackDefense.Device.sensor_out_of_date
      description: Whether there is a new version available to be installed.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.sensor_pending_update
      description: Whether the sensor is marked by the sensor updater service for a sensor upgrade.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.sensor_states
      description: The states the sensor is in. For example [ "ACTIVE", "LIVE_RESPONSE_ENABLED" ]. (ACTIVE, PANICS_DETECTED, LOOP_DETECTED, DB_CORRUPTION_DETECTED, CSR_ACTION, REPUX_ACTION, DRIVER_INIT_ERROR, REMGR_INIT_ERROR, UNSUPPORTED_OS, SENSOR_UPGRADE_IN_PROGRESS, SENSOR_UNREGISTERED, WATCHDOG, SENSOR_RESET_IN_PROGRESS, DRIVER_INIT_REBOOT_REQUIRED, DRIVER_LOAD_NOT_GRANTED, SENSOR_SHUTDOWN, SENSOR_MAINTENANCE, FULL_DISK_ACCESS_NOT_GRANTED, DEBUG_MODE_ENABLED, AUTO_UPDATE_DISABLED, SELF_PROTECT_DISABLED, VDI_MODE_ENABLED, POC_MODE_ENABLED, SECURITY_CENTER_OPTLN_DISABLED, LIVE_RESPONSE_RUNNING, LIVE_RESPONSE_NOT_RUNNING, LIVE_RESPONSE_KILLED, LIVE_RESPONSE_NOT_KILLED, LIVE_RESPONSE_ENABLED, LIVE_RESPONSE_DISABLED, DRIVER_KERNEL, DRIVER_USERSPACE).
      type: String
    - contextPath: CarbonBlackDefense.Device.sensor_version
      description: 'The version of the installed sensor in the format: #.#.#.#.'
      type: String
    - contextPath: CarbonBlackDefense.Device.status
      description: The status of the device. (PENDING, REGISTERED, DEREGISTERED, BYPASS Additional searchable statuses that are not returnable ACTIVE, INACTIVE, ERROR, ALL, BYPASS_ON, LIVE, SENSOR_PENDING_UPDATE).
      type: String
    - contextPath: CarbonBlackDefense.Device.target_priority
      description: Device target priorities to match. (LOW, MEDIUM, HIGH, MISSION_CRITICAL).
      type: String
    - contextPath: CarbonBlackDefense.Device.uninstall_code
      description: The code to enter when uninstalling the sensor.
      type: String
    - contextPath: CarbonBlackDefense.Device.vcenter_host_url
      description: The vCenter host URL.
      type: String
    - contextPath: CarbonBlackDefense.Device.vcenter_name
      description: The name of the vCenter the VM is associated with.
      type: String
    - contextPath: CarbonBlackDefense.Device.vcenter_uuid
      description: The 128-bit SMBIOS UUID of a vCenter represented as a hexadecimal string.
      type: String
    - contextPath: CarbonBlackDefense.Device.vdi_base_device
      description: The identifier of the device from which this device was cloned/re-registered.
      type: Number
    - contextPath: CarbonBlackDefense.Device.virtual_machine
      description: Whether this device is a virtual machine (VMware AppDefense integration). Deprecated for deployment_type.
      type: Boolean
    - contextPath: CarbonBlackDefense.Device.virtualization_provider
      description: The name of the VM virtualization provider.
      type: String
    - contextPath: CarbonBlackDefense.Device.vm_ip
      description: The IP address of the VM.
      type: String
    - contextPath: CarbonBlackDefense.Device.vm_name
      description: The name of the VM that the sensor is deployed on.
      type: String
    - contextPath: CarbonBlackDefense.Device.vm_uuid
      description: 'The 128-bit SMBIOS UUID of a virtual machine represented as a hexadecimal string. (Format: 12345678-abcd-1234-cdef-123456789abc).'
      type: String
    - contextPath: CarbonBlackDefense.Device.vulnerability_score
      description: The vulnerability score from 0 to 100 indicating the workload’s level of vulnerability with 100 being highly vulnerable.
      type: Number
    - contextPath: CarbonBlackDefense.Device.vulnerability_severity
      description: The severity level indicating the workload’s vulnerability. (CRITICAL, MODERATE, IMPORTANT, LOW).
      type: String
    - contextPath: CarbonBlackDefense.Device.windows_platform
      description: Deprecated for os_version. (CLIENT_X86, CLIENT_X64, SERVER_X86, SERVER_X64, CLIENT_ARM64, SERVER_ARM64).
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'The Carbon Black Cloud classification for events tagged to an alert. Possible values: "THREAT" and "OBSERVED".'
      name: alert_category
      predefined:
      - THREAT
      - OBSERVED
    - description: The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format.
      name: device_external_ip
    - description: The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments.
      name: device_id
    - description: The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format.
      name: device_internal_ip
    - description: The hostname of the endpoint recorded by the sensor when last initialized.
      name: device_name
    - auto: PREDEFINED
      description: 'The operating system of the endpoint. Possible values: "WINDOWS", "MAC", "LINUX".'
      name: device_os
      predefined:
      - WINDOWS
      - MAC
      - LINUX
    - description: 'The sensor-reported timestamp of the batch of events in which this record was submitted to Carbon Black Cloud. specified as ISO 8601 timestamp in UTC for example: 2020-01-19T04:28:40.190Z.'
      name: device_timestamp
    - auto: PREDEFINED
      description: 'The type of enriched event observed. Possible value: "filemod", "netconn", "regmod", "modload", "crossproc", "childproc", "scriptload", and "fileless_scriptload".'
      name: event_type
      predefined:
      - filemod
      - netconn
      - regmod
      - modload
      - crossproc
      - childproc
      - scriptload
      - fileless_scriptload
    - description: The file system path of the parent process binary.
      name: parent_name
    - auto: PREDEFINED
      description: 'The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".'
      name: parent_reputation
      predefined:
      - ADAPTIVE_WHITE_LIST
      - ADWARE
      - COMMON_WHITE_LIST
      - COMPANY_BLACK_LIST
      - COMPANY_WHITE_LIST
      - HEURISTIC
      - IGNORE
      - KNOWN_MALWARE
      - LOCAL_WHITE
      - NOT_LISTED
      - PUP
      - RESOLVING
      - SUSPECT_MALWARE
      - TRUSTED_WHITE_LIST
    - description: The command line executed by the actor process.
      name: process_cmdline
    - description: The unique process identifier for the actor process.
      name: process_guid
    - description: Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash).
      name: hash
    - description: The file system path of the actor process binary.
      name: process_name
    - description: The process identifier assigned by the operating system. This can be multi-valued in case of fork() or exec() process operations on Linux and macOS.
      name: process_pid
    - auto: PREDEFINED
      description: 'The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".'
      name: process_reputation
      predefined:
      - ADAPTIVE_WHITE_LIST
      - ADWARE
      - COMMON_WHITE_LIST
      - COMPANY_BLACK_LIST
      - COMPANY_WHITE_LIST
      - HEURISTIC
      - IGNORE
      - KNOWN_MALWARE
      - LOCAL_WHITE
      - NOT_LISTED
      - PUP
      - RESOLVING
      - SUSPECT_MALWARE
      - TRUSTED_WHITE_LIST
    - description: 'The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts.'
      name: process_start_time
    - auto: PREDEFINED
      description: 'Whether the process has terminated. Possible values: "true" and "false". Always "false" for enriched events (process termination not recorded).'
      name: process_terminated
      predefined:
      - 'true'
      - 'false'
    - description: |-
        The user context in which the actor process was executed.
        MacOS - all users for the PID for fork() and exec() transitions.
        Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid().
      name: process_username
    - auto: PREDEFINED
      description: 'The action performed by the sensor on the process. Possible values: "TERMINATE", "DENY", and "SUSPEND".'
      name: sensor_action
      predefined:
      - TERMINATE
      - DENY
      - SUSPEND
    - description: The query in Lucene syntax and/or value searches.
      name: query
    - description: The number of rows to request. Can be paginated.
      name: rows
    - description: The first row to use for pagination.
      name: start
    - description: 'The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp.'
      name: time_range
    description: 'Creates a process search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, and time_range) is required.'
    name: cbd-find-processes
    outputs:
    - contextPath: CarbonBlackDefense.Process.Search.job_id
      description: The job ID of the process search.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'The Carbon Black Cloud classification for events tagged to an alert. Possible values: "THREAT" and "OBSERVED".'
      name: alert_category
      predefined:
      - THREAT
      - OBSERVED
    - description: The IP address of the endpoint according to Carbon Black Cloud. This IP address can differ from the device_internal_ip due to network proxy or NAT. Can be either IPv4 or IPv6 format.
      name: device_external_ip
    - description: The ID assigned to the endpoint by Carbon Black Cloud. This ID is unique across all Carbon Black Cloud environments.
      name: device_id
    - description: The IP address of the endpoint reported by the sensor. Can be either IPv4 or IPv6 format.
      name: device_internal_ip
    - description: The hostname of the endpoint recorded by the sensor when last initialized.
      name: device_name
    - auto: PREDEFINED
      description: 'The operating system of the endpoint. Possible values: "WINDOWS", "MAC", "LINUX".'
      name: device_os
      predefined:
      - WINDOWS
      - MAC
      - LINUX
    - auto: PREDEFINED
      description: 'The type of enriched event observed. Possible value: "filemod", "netconn", "regmod", "modload", "crossproc", "childproc", "scriptload", and "fileless_scriptload".'
      name: event_type
      predefined:
      - filemod
      - netconn
      - regmod
      - modload
      - crossproc
      - childproc
      - scriptload
      - fileless_scriptload
    - description: The file system path of the parent process binary.
      name: parent_name
    - auto: PREDEFINED
      description: 'The reputation of the parent process applied by Carbon Black Cloud when the event is initially processed. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".'
      name: parent_reputation
      predefined:
      - ADAPTIVE_WHITE_LIST
      - ADWARE
      - COMMON_WHITE_LIST
      - COMPANY_BLACK_LIST
      - COMPANY_WHITE_LIST
      - HEURISTIC
      - IGNORE
      - KNOWN_MALWARE
      - LOCAL_WHITE
      - NOT_LISTED
      - PUP
      - RESOLVING
      - SUSPECT_MALWARE
      - TRUSTED_WHITE_LIST
    - description: The command line executed by the actor process.
      name: process_cmdline
    - description: The unique process identifier for the actor process.
      name: process_guid
    - description: Aggregate set of MD5 and SHA-256 hashes associated with the process (including childproc_hash, crossproc_hash, filemod_hash, modload_hash, process_hash).
      name: hash
    - description: The file system path of the actor process binary.
      name: process_name
    - description: The process identifier assigned by the operating system. This can be multi-valued in case of fork() or exec() process operations on Linux and macOS.
      name: process_pid
    - auto: PREDEFINED
      description: 'The reputation of the actor process applied when the event is processed by Carbon Black Cloud. Possible values: "ADAPTIVE_WHITE_LIST", "ADWARE", "COMMON_WHITE_LIST", "COMPANY_BLACK_LIST", "COMPANY_WHITE_LIST", "HEURISTIC", "IGNORE", "KNOWN_MALWARE", "LOCAL_WHITE", "NOT_LISTED", "PUP", "RESOLVING", "SUSPECT_MALWARE", and "TRUSTED_WHITE_LIST".'
      name: process_reputation
      predefined:
      - ADAPTIVE_WHITE_LIST
      - ADWARE
      - COMMON_WHITE_LIST
      - COMPANY_BLACK_LIST
      - COMPANY_WHITE_LIST
      - HEURISTIC
      - IGNORE
      - KNOWN_MALWARE
      - LOCAL_WHITE
      - NOT_LISTED
      - PUP
      - RESOLVING
      - SUSPECT_MALWARE
      - TRUSTED_WHITE_LIST
    - description: 'The sensor reported timestamp of when the process started. specified as ISO 8601 timestamp in UTC for example: 2020-05-04T21:34:03.968Z. This is not available for processes running before the sensor starts.'
      name: process_start_time
    - auto: PREDEFINED
      description: 'Whether the process has terminated. Possible values: "true" and "false". Always "false" for enriched events (process termination not recorded).'
      name: process_terminated
      predefined:
      - 'true'
      - 'false'
    - description: |-
        The user context in which the actor process was executed.
        MacOS - all users for the PID for fork() and exec() transitions.
        Linux - process user for exec() events, but in a future sensor release can be multi-valued due to setuid().
      name: process_username
    - auto: PREDEFINED
      description: 'The action performed by the sensor on the process. Possible values: "TERMINATE", "DENY", and "SUSPEND".'
      name: sensor_action
      predefined:
      - TERMINATE
      - DENY
      - SUSPEND
    - description: The query in Lucene syntax and/or value searches.
      name: query
    - description: The number of rows to request. Can be paginated.
      name: rows
    - description: The first row to use for pagination.
      name: start
    - description: 'The time window in which to restrict the search to match using device_timestamp as the reference. The window value will take priority over the start and end times if provided. For example {"end": "2020-01-21T18:34:04Z", "start": "2020-01-18T18:34:04Z", "window": "-2w"}, window: “-2w” (where y=year, w=week, d=day, h=hour, m=minute, s=second) start: ISO 8601 timestamp, end: ISO 8601 timestamp.'
      name: time_range
    description: 'Creates an enriched events search job. The results for the search job may be requested using the returned job ID. At least one of the arguments (not including: rows, start, time_range) is required).'
    name: cbd-find-events
    outputs:
    - contextPath: CarbonBlackDefense.Events.Search.job_id
      description: The job ID of the event search.
      type: String
  - arguments:
    - description: The job ID.
      name: job_id
      required: true
    - defaultValue: '10'
      description: The number of rows to request. Can be paginated. Default is 10.
      name: rows
    description: Retrieves the results of a process search identified by the job ID.
    name: cbd-find-processes-results
    outputs:
    - contextPath: CarbonBlackDefense.Process.Results.job_id
      description: The job_id of the process search.
      type: String
    - contextPath: CarbonBlackDefense.Process.Results.approximate_unaggregated
      description: The approximate number of unaggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.completed
      description: The number of completed results.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.contacted
      description: The number of contacted results.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.num_aggregated
      description: The number of aggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.num_available
      description: The number of processes available in this search.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.num_found
      description: The number of processes found in this search.
      type: Number
    - contextPath: CarbonBlackDefense.Process.Results.results
      description: The lists that contains the data of the results for this search.
      type: Unknown
  - description: Gets the list of policies available in your organization.
    name: cbd-get-policies
    outputs:
    - contextPath: CarbonBlackDefense.Policy.id
      description: The policy ID.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.priorityLevel
      description: The policy priority level.
      type: String
    - contextPath: CarbonBlackDefense.Policy.systemPolicy
      description: Whether the policy is a system policy.
      type: Boolean
    - contextPath: CarbonBlackDefense.Policy.latestRevision
      description: The latest revision of the policy.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.policy
      description: The policy object.
      type: Unknown
    - contextPath: CarbonBlackDefense.Policy.name
      description: The unique name of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.version
      description: The version of the policy.
      type: Number
  - arguments:
    - description: The policy ID.
      name: policyId
      required: true
    description: Retrieves a policy object by ID.
    name: cbd-get-policy
    outputs:
    - contextPath: CarbonBlackDefense.Policy.id
      description: The policy ID.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.priorityLevel
      description: The policy priority level.
      type: String
    - contextPath: CarbonBlackDefense.Policy.systemPolicy
      description: Whether the policy is a system policy.
      type: Boolean
    - contextPath: CarbonBlackDefense.Policy.latestRevision
      description: The latest revision of the policy.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.policy
      description: The policy object.
      type: Unknown
    - contextPath: CarbonBlackDefense.Policy.name
      description: The unique name of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.version
      description: The version of the policy.
      type: Number
  - arguments:
    - description: The policy ID to be set.
      name: policy
      required: true
    - description: A JSON object that holds key/value pairs. The key is the field path in the policy object you want to update with a value.
      name: keyValue
      required: true
    description: Resets policy fields.
    name: cbd-set-policy
    outputs:
    - contextPath: CarbonBlackDefense.Policy.id
      description: The policy ID.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.priorityLevel
      description: The policy priority level.
      type: String
    - contextPath: CarbonBlackDefense.Policy.systemPolicy
      description: Whether the policy is a system policy.
      type: Boolean
    - contextPath: CarbonBlackDefense.Policy.latestRevision
      description: The latest revision of the policy.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.policy
      description: The policy object.
      type: Unknown
    - contextPath: CarbonBlackDefense.Policy.name
      description: The unique name of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.version
      description: The version of the policy.
      type: Number
  - arguments:
    - description: A description of the policy. Can be multiple lines.
      name: description
      required: true
    - description: A unique one-line name for the policy.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The priority score associated with sensors assigned to this policy. Possible values: "MISSION_CRITICAL", "HIGH", "MEDIUM", and "LOW".'
      name: priorityLevel
      predefined:
      - MISSION_CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      required: true
    - description: The JSON object containing the policy details. Make sure a valid policy object is passed. You can use the get-policy command to retrieve a similar policy object. Then you can reset some of the policy's fields with the set-policy command, and pass the edited object.
      name: policy
      required: true
    description: Creates a new policy on the CB Defense backend.
    name: cbd-create-policy
    outputs:
    - contextPath: CarbonBlackDefense.Policy.id
      description: The policy ID.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.priorityLevel
      description: The policy priority level.
      type: String
    - contextPath: CarbonBlackDefense.Policy.systemPolicy
      description: Whether the policy is a system policy.
      type: Boolean
    - contextPath: CarbonBlackDefense.Policy.latestRevision
      description: The latest revision of the policy.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.policy
      description: The policy object.
      type: Unknown
    - contextPath: CarbonBlackDefense.Policy.name
      description: The unique name of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.version
      description: The version of the policy.
      type: Number
  - arguments:
    - description: The policy ID.
      name: policyId
      required: true
    description: 'Deletes a policy from the CB Defense backend. This may return an error if devices are actively assigned to the policy ID requested for deletion. Note: System policies cannot be deleted.'
    name: cbd-delete-policy
  - arguments:
    - description: A description of the policy.
      name: description
      required: true
    - description: A one-line name for the policy.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The priority score associated with sensors assigned to this policy. Possible values: "MISSION_CRITICAL", "HIGH", "MEDIUM", and "LOW".'
      name: priorityLevel
      predefined:
      - MISSION_CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      required: true
    - description: The ID of the policy to replace.
      name: id
      required: true
    - description: 'The JSON object containing the policy details. Make sure a valid policy object is passed. For example {''sensorSettings'': [{''name'': ''SHOW_UI'', ''value'': ''false''}]}. You can use the get-policy command to retrieve the policy object you want to update. Then you can reset some of the policy''s fields with the set-policy command, and pass the edited object.'
      name: policy
      required: true
    description: 'Updates an existing policy with a new policy. Note: System policies cannot be modified.'
    name: cbd-update-policy
    outputs:
    - contextPath: CarbonBlackDefense.Policy.id
      description: The policy ID.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.priorityLevel
      description: The policy priority level.
      type: String
    - contextPath: CarbonBlackDefense.Policy.systemPolicy
      description: Whether the policy is a system policy.
      type: Boolean
    - contextPath: CarbonBlackDefense.Policy.latestRevision
      description: The latest revision of the policy.
      type: Number
    - contextPath: CarbonBlackDefense.Policy.policy
      description: The policy object.
      type: Unknown
    - contextPath: CarbonBlackDefense.Policy.name
      description: The unique name of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: CarbonBlackDefense.Policy.version
      description: The version of the policy.
      type: Number
  - arguments:
    - auto: PREDEFINED
      description: 'Rule action. Possible values: "TERMINATE", "IGNORE", "TERMINATE_THREAD", "ALLOW", "DENY", and "TERMINATE_PROCESS".'
      name: action
      predefined:
      - TERMINATE
      - IGNORE
      - TERMINATE_THREAD
      - ALLOW
      - DENY
      - TERMINATE_PROCESS
      required: true
    - auto: PREDEFINED
      description: Rule operation.
      name: operation
      predefined:
      - MODIFY_SYSTEM_EXE
      - PASSTHRU
      - CRED
      - RANSOM
      - NETWORK_SERVER
      - POL_INVOKE_NOT_TRUSTED
      - IMPERSONATE
      - MICROPHONE_CAMERA
      - INVOKE_SYSAPP
      - NETWORK_CLIENT
      - BYPASS_REG
      - BUFFER_OVERFLOW
      - BYPASS_API
      - USER_DOC
      - CODE_INJECTION
      - BYPASS_NET
      - KEYBOARD
      - BYPASS_ALL
      - RUN
      - INVOKE_CMD_INTERPRETER
      - MODIFY_SYTEM_CONFIG
      - ESCALATE
      - BYPASS_FILE
      - RUN_AS_ADMIN
      - BYPASS_PROCESS
      - NETWORK
      - KERNEL_ACCESS
      - NETWORK_PEER
      - PACKED
      - INVOKE_SCRIPT
      - MEMORY_SCRAPE
      - BYPASS_SELF_PROTECT
      - TAMPER_API
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is required. Possible values: "true" and "false".'
      name: required
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: 'Application type. Possible values: "REPUTATION", "SIGNED_BY", and "NAME_PATH".'
      name: type
      predefined:
      - REPUTATION
      - SIGNED_BY
      - NAME_PATH
      required: true
    - description: Application value.
      name: value
      required: true
    - description: The policy ID.
      name: policyId
      required: true
    description: 'Adds a new rule to an existing policy. Note: System policies cannot be modified.'
    name: cbd-add-rule-to-policy
  - arguments:
    - auto: PREDEFINED
      description: 'Rule action. Possible values: "TERMINATE", "IGNORE", "TERMINATE_THREAD", "ALLOW", "DENY", and "TERMINATE_PROCESS".'
      name: action
      predefined:
      - TERMINATE
      - IGNORE
      - TERMINATE_THREAD
      - ALLOW
      - DENY
      - TERMINATE_PROCESS
      required: true
    - auto: PREDEFINED
      description: Rule operation.
      name: operation
      predefined:
      - MODIFY_SYSTEM_EXE
      - PASSTHRU
      - CRED
      - RANSOM
      - NETWORK_SERVER
      - POL_INVOKE_NOT_TRUSTED
      - IMPERSONATE
      - MICROPHONE_CAMERA
      - INVOKE_SYSAPP
      - NETWORK_CLIENT
      - BYPASS_REG
      - BUFFER_OVERFLOW
      - BYPASS_API
      - USER_DOC
      - CODE_INJECTION
      - BYPASS_NET
      - KEYBOARD
      - BYPASS_ALL
      - RUN
      - INVOKE_CMD_INTERPRETER
      - MODIFY_SYTEM_CONFIG
      - ESCALATE
      - BYPASS_FILE
      - RUN_AS_ADMIN
      - BYPASS_PROCESS
      - NETWORK
      - KERNEL_ACCESS
      - NETWORK_PEER
      - PACKED
      - INVOKE_SCRIPT
      - MEMORY_SCRAPE
      - BYPASS_SELF_PROTECT
      - TAMPER_API
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is required. Possible values: "true" and "false".'
      name: required
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: Rule ID.
      name: id
      required: true
    - auto: PREDEFINED
      description: 'Application type. Possible values: "REPUTATION", "SIGNED_BY", and "NAME_PATH".'
      name: type
      predefined:
      - REPUTATION
      - SIGNED_BY
      - NAME_PATH
      required: true
    - description: Application value.
      name: value
      required: true
    - description: The policy ID.
      name: policyId
      required: true
    description: 'Updates an existing rule with a new rule. Note: System policies cannot be modified.'
    name: cbd-update-rule-in-policy
  - arguments:
    - description: The policy ID.
      name: policyId
      required: true
    - description: The rule ID.
      name: ruleId
      required: true
    description: 'Removes a rule from an existing policy. Note: System policies cannot be modified.'
    name: cbd-delete-rule-from-policy
  - arguments:
    - description: The job ID.
      isArray: true
      name: job_id
      required: true
    - description: The number of rows to request. Can be paginated. Default is 10.
      name: rows
    description: Retrieves the result for an enriched events search request for a given job ID. By default returns 10 rows.
    name: cbd-find-events-results
    outputs:
    - contextPath: CarbonBlackDefense.Events.Results.job_id
      description: The job_id of the events search.
      type: String
    - contextPath: CarbonBlackDefense.Events.Results.approximate_unaggregated
      description: The approximate number of unaggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.completed
      description: The number of completed results.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.contacted
      description: The number of contacted results.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.num_aggregated
      description: The number of aggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.num_available
      description: The number of events available in this search.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.num_found
      description: The number of events found in this search.
      type: Number
    - contextPath: CarbonBlackDefense.Events.Results.results
      description: The lists that contains the data of the results for this search.
      type: Unknown
  - arguments:
    - description: A comma-separated list of event IDs to fetch.
      name: event_ids
      required: true
    description: Initiates a request to retrieve detail fields for enriched events.  the job_id that returns from this command can be used to get the results using the "cbd-find-events-details-results" command.
    name: cbd-find-events-details
    outputs:
    - contextPath: CarbonBlackDefense.EventDetails.Search.job_id
      description: The job ID.
      type: String
  - arguments:
    - description: The job ID.
      name: job_id
    description: Retrieves the status for an enriched events detail request for a given job ID.
    name: cbd-find-events-details-results
    outputs:
    - contextPath: CarbonBlackDefense.EventDetails.Results.job_id
      description: The job_id of the event details search.
      type: String
    - contextPath: CarbonBlackDefense.EventDetails.Results.approximate_unaggregated
      description: The approximate number of unaggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.completed
      description: The number of completed results.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.contacted
      description: The number of contacted results.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.num_aggregated
      description: The number of aggregated results.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.num_available
      description: The number of event details available in this search.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.num_found
      description: The number of event details found in this search.
      type: Number
    - contextPath: CarbonBlackDefense.EventDetails.Results.results
      description: The lists that contains the data of the results for this search.
      type: Unknown
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Quarantines the device. Not supported for devices in a Linux operating system.
    name: cbd-device-quarantine
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Unquarantines the device. Not supported for devices in a Linux operating system.
    name: cbd-device-unquarantine
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Starts a background scan on the device. Not supported for devices in a Linux operating system.
    name: cbd-device-background-scan
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Stops a background scan on the device. Not supported for devices in a Linux operating system.
    name: cbd-device-background-scan-stop
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Bypasses a device.
    name: cbd-device-bypass
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    description: Unbypasses a device.
    name: cbd-device-unbypass
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    - description: The ID of the policy.
      name: policy_id
      required: true
    description: Updates the devices to the specified policy ID.
    name: cbd-device-policy-update
  - arguments:
    - description: The ID of the device.
      name: device_id
      required: true
    - auto: PREDEFINED
      description: 'The new version of the sensor. For example: { "MAC": "1.2.3.4" }. Supported types: XP, WINDOWS, MAC, AV_SIG, OTHER, RHEL, UBUNTU, SUSE, AMAZON_LINUX, MAC_OSX.'
      name: sensor_version
      predefined:
      - '{"XP":}'
      - '{"WINDOWS":}'
      - '{"MAC":}'
      - '{"AV_SIG":}'
      - '{"OTHER":}'
      - '{"RHEL":}'
      - '{"UBUNTU":}'
      - '{"SUSE":}'
      - '{"AMAZON_LINUX":}'
      - '{"MAC_OSX":}'
      required: true
    description: Updates the version of a sensor.
    name: cbd-device-update-sensor-version
  - arguments:
    - auto: PREDEFINED
      description: 'The type of the alerts. Possible values: "cbAnalytics", "devicecontrol", "all".'
      name: type
      predefined:
      - cbanalytics
      - devicecontrol
      - all
    - auto: PREDEFINED
      description: 'The category of the alert. Possible values: "THREAT", "MONITORED".'
      name: category
      predefined:
      - THREAT
      - MONITORED
    - description: The device ID.
      name: device_id
    - description: 'The time of the first event associated with the alert. The syntax is  {"start": "<dateTime>", "range": "<string>", "end": "<dateTime>" }. For example: { "start": "2010-09-25T00:10:50.277Z", "end": "2015-01-20T10:40:00.00Z"}.'
      name: first_event_time
    - description: The policy ID.
      name: policy_id
    - description: The SHA-256 hash of the primary involved process.
      name: process_sha256
    - description: 'The reputation of the primary involved process. Possible values: "KNOWN_MALWARE", "NOT_LISTED", etc.'
      name: reputation
    - description: The tags associated with the alert.
      name: tag
    - description: The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner.
      name: device_username
    - description: The query in Lucene syntax and/or value searches.
      name: query
    - description: The number of results to be returned.
      name: rows
    - description: The number of the alert from where to start retrieving results.
      name: start
    description: Gets details on the events that led to an alert. This includes retrieving metadata around the alert as well as the event associated with the alert.
    name: cbd-alerts-search
    outputs:
    - contextPath: CarbonBlackDefense.Alert.id
      description: The identifier for the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.legacy_alert_id
      description: The unique short ID for the alerts to support easier consumption in the UI console. Use the ID for API requests.
      type: String
    - contextPath: CarbonBlackDefense.Alert.org_key
      description: The unique identifier for the organization associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.create_time
      description: The time the alert was created.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.last_update_time
      description: The last time the alert was updated.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.first_event_time
      description: The time of the first event associated with the alert.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.last_event_time
      description: The time of the latest event associated with the alert.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.threat_id
      description: The identifier of a threat that this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices.
      type: String
    - contextPath: CarbonBlackDefense.Alert.severity
      description: The threat ranking of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.category
      description: The category of the alert. (THREAT, MONITORED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_id
      description: The identifier assigned by Carbon Black Cloud to the device associated with the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.device_os
      description: The operating system of the device associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_os_version
      description: The operating system and version on the device.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_name
      description: The hostname of the device associated with the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_username
      description: The username of the user logged on during the alert. If the user is not available then this may be populated with the device owner.
      type: String
    - contextPath: CarbonBlackDefense.Alert.policy_id
      description: The identifier for the policy associated with the device at the time of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.policy_name
      description: The name of the policy associated with the device at the time of the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.target_value
      description: The priority of the device assigned by the policy.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.state
      description: The state of the tracking system for alerts as they are triaged and resolved. Supported states are OPEN or DISMISSED.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.remediation
      description: The state of the workflow of the tracking system for alerts as they are triaged and resolved. Supported states are OPEN or DISMISSED.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.last_update_time
      description: The last time the alert was updated.
      type: Date
    - contextPath: CarbonBlackDefense.Alert.workflow.comment
      description: The comment about the workflow of the tracking system for alerts as they are triaged and resolved.
      type: String
    - contextPath: CarbonBlackDefense.Alert.workflow.changed_by
      description: The name of the user who changed the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.notes_present
      description: Indicates if notes are associated with the threat ID.
      type: Boolean
    - contextPath: CarbonBlackDefense.Alert.tags
      description: Tags associated with the alert ([ "tag1", "tag2" ]).
      type: Unknown
    - contextPath: CarbonBlackDefense.Alert.reason
      description: The description of the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.count
      description: The count of the alert.
      type: Number
    - contextPath: CarbonBlackDefense.Alert.report_id
      description: The identifier of the report that contains the IOC.
      type: String
    - contextPath: CarbonBlackDefense.Alert.report_name
      description: The name of the report that contains the IOC.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_id
      description: The identifier of the IOC that cause the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_field
      description: The indicator of comprise (IOC) field that the hit contains.
      type: String
    - contextPath: CarbonBlackDefense.Alert.ioc_hit
      description: IOC field value or IOC that matches the query.
      type: String
    - contextPath: CarbonBlackDefense.Alert.watchlists.id
      description: The ID of the watchlists associated with an alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.watchlists.name
      description: The name of the watchlists associated with an alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.process_guid
      description: The global unique identifier of the process that triggered the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.process_name
      description: The name of the process that triggered the hit.
      type: String
    - contextPath: CarbonBlackDefense.Alert.run_state
      description: Run state for watchlist alerts. This value is always "RAN".
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.process_name
      description: The name of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.sha256
      description: The SHA-256 hash of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_indicators.ttps
      description: The tactics, techniques, and procedures (TTPs) of the threat indicators that make up the threat.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_sha256
      description: The SHA-256 hash of the threat cause actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_md5
      description: The SHA-256 hash of the threat cause actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_name
      description: Process name or IP address of the threat actor.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_reputation
      description: The reputation of the threat cause. (KNOWN_MALWARE, SUSPECT_MALWARE, PUP, NOT_LISTED, ADAPTIVE_WHITE_LIST, COMMON_WHITE_LIST, TRUSTED_WHITE_LIST, COMPANY_BLACK_LIST).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_threat_category
      description: The category of the threat cause. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_vector
      description: The source of the threat cause. (EMAIL, WEB, GENERIC_SERVER, GENERIC_CLIENT, REMOTE_DRIVE, REMOVABLE_MEDIA, UNKNOWN, APP_STORE, THIRD_PARTY).
      type: String
    - contextPath: CarbonBlackDefense.Alert.document_guid
      description: The document GUID.
      type: String
    - contextPath: CarbonBlackDefense.Alert.type
      description: The type of alert. (CB_ANALYTICS, DEVICE_CONTROL).
      type: String
    - contextPath: CarbonBlackDefense.Alert.reason_code
      description: The shorthand enum for the full-text reason.
      type: String
    - contextPath: CarbonBlackDefense.Alert.device_location
      description: Whether the device was on-premise or off-premise when the alert started. (ONSITE, OFFSITE, UNKNOWN).
      type: String
    - contextPath: CarbonBlackDefense.Alert.created_by_event_id
      description: Event identifier that initiated the alert.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_dlp
      description: Whether the alert involved data loss prevention (DLP). (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_phish
      description: Whether the alert involved phishing. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_activity_c2
      description: Whether the alert involved a command and control (c2) server. (NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED).
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_actor_process_pid
      description: The process identifier (PID) of the actor process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_process_guid
      description: The GUID of the process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_parent_guid
      description: The parent GUID of the process.
      type: String
    - contextPath: CarbonBlackDefense.Alert.threat_cause_cause_event_id
      description: The threat cause cause event ID.
      type: String
    - contextPath: CarbonBlackDefense.Alert.blocked_threat_category
      description: The category of threat which we were able to take action on. (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.not_blocked_threat_category
      description: Other potentially malicious activity involved in the threat on which we weren’t able to take action (either due to policy config, or not having a relevant rule). (UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM).
      type: String
    - contextPath: CarbonBlackDefense.Alert.kill_chain_status
      description: The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. (RECONNAISSANCE, WEAPONIZE, DELIVER_EXPLOIT, INSTALL_RUN, COMMAND_AND_CONTROL, EXECUTE_GOAL, BREACH). For example [ "EXECUTE_GOAL", "BREACH" ].
      type: String
    - contextPath: CarbonBlackDefense.Alert.sensor_action
      description: The action taken by the sensor, according to the rule of the policy. (POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY).
      type: String
    - contextPath: CarbonBlackDefense.Alert.policy_applied
      description: Whether a policy was applied. (APPLIED, NOT_APPLIED).
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- carbonBlackEndpointStandardTestPlaybook
fromversion: 5.5.0