category: Endpoint
provider: Broadcom
sectionorder:
- Connect
- Collect
commonfields:
  id: Carbon Black Enterprise EDR
  version: -1
configuration:
- display: Server URL (e.g. https://defense.conferdeploy.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: Organization Key
  name: organization_key
  required: true
  type: 0
  section: Connect
- display: Custom Key
  name: custom_key
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Custom ID
  name: custom_id
  type: 0
  section: Connect
  hidden: true
  required: false
- display: Custom ID
  name: credentials_custom
  type: 9
  displaypassword: Custom Key
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: '3 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- defaultvalue: '50'
  display: Fetch limit
  name: fetch_limit
  type: 0
  section: Collect
  required: false
  additionalinfo: If the API returns duplicates, the duplicates will be dropped, causing the total number of alerts fetched to potentially be fewer than the set limit.
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  section: Collect
  type: 19
description: VMware Carbon Black Enterprise EDR (formerly known as Carbon Black ThreatHunter) is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter).
display: Carbon Black Enterprise EDR
name: Carbon Black Enterprise EDR
script:
  commands:
  - arguments:
    - description: The ID of the alert to update. Get the ID from list-alerts command.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Workflow state to update.
      name: state
      predefined:
      - IN_PROGRESS
      - CLOSED
      - DISMISSED
      - OPEN
    - description: Value judgement of whether the alert(s) represent a true or false positive.
      name: remediation_state
      auto: PREDEFINED
      predefined:
      - TRUE_POSITIVE
      - FALSE_POSITIVE
      - NONE
    - description: Relative time range for the request. Should not be provided if using `start` and `end` arguments.
      name: time_range
      defaultValue: -2w
    - name: start
      description: The lower bound of the time range. Requires end and must be a timestamp before end.
    - name: end
      description: The upper bound of the time range. Requires start and must be a timestamp after start.
    - name: closure_reason
      description: The closure reason.
      auto: PREDEFINED
      predefined:
      - NO_REASON
      - RESOLVED
      - RESOLVED_BENIGN_KNOWN_GOOD
      - DUPLICATE_CLEANUP
      - OTHER
    - description: Comment to include with the operation.
      name: comment
    - description: Request ID to retrieve.
      name: request_id
      hidden: true
    description: Updates the workflow of a single alert.
    name: cb-eedr-alert-workflow-update
    outputs:
    - contextPath: CarbonBlackEEDR.Alert.AlertID
      description: The alert ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.ChangedBy
      description: User that changed the ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.Comment
      description: Comment that was included with the operation.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.LastUpdateTime
      description: Last time the alert was updated.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.Remediation
      description: Description or justification for the change.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.State
      description: The alert state.
      type: String
    polling: true
  - arguments:
    - description: The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values.
      name: device_id
      required: true
    description: Quarantines a device.
    name: cb-eedr-device-quarantine
  - arguments:
    - description: The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values.
      isArray: true
      name: device_id
      required: true
    description: Removes a device from quarantine.
    name: cb-eedr-device-unquarantine
  - arguments:
    - description: The device ID. Get the ID from the devices-list command. Supports comma-separated values.
      name: device_id
      required: true
    description: Stops a background scan on the specified devices.
    name: cb-eedr-device-background-scan-stop
  - arguments:
    - description: The device ID. Get the ID from the devices-list command. Supports comma-separated values.
      name: device_id
      required: true
    description: Start a background scan on device.
    name: cb-eedr-device-background-scan
  - arguments:
    - description: The device ID. Get the ID from the devices-list command. Support comma-separated values.
      name: device_id
      required: true
    description: Enable a bypass on device.
    name: cb-eedr-device-bypass
  - arguments:
    - description: The device ID. Get the ID from the devices-list command. Support comma-separated values.
      name: device_id
      required: true
    description: Disable a bypass on device.
    name: cb-eedr-device-unbypass
  - arguments:
    - description: The device ID. Get the ID from the devices-list command. Support comma-separated values.
      name: device_id
      required: true
    - description: The policy ID.
      name: policy_id
      required: true
    description: Update device policy.
    name: cb-eedr-device-policy-update
  - arguments:
    - description: The device ID. Supports comma-separated values.
      name: device_id
    - auto: PREDEFINED
      description: The device status. Supports comma-separated values.
      name: status
      predefined:
      - PENDING
      - REGISTERED
      - UNINSTALLED
      - DEREGISTERED
      - ACTIVE
      - INACTIVE
      - ERROR
      - ALL
      - BYPASS_ON
      - BYPASS
      - QUARANTINE
      - SENSOR_OUTOFDATE
      - DELETED
      - LIVE
    - description: Device operation system. Supports comma-separated values.
      name: device_os
    - description: 'Device start last contact time. For example: 2019-01-01T11:00:00.157Z.'
      name: start_time
    - description: 'Device end last contact time. For example: 2019-01-01T11:00:00.157Z.'
      name: end_time
    - description: Active directory group ID. Supports comma-separated values.
      name: ad_group_id
    - description: The policy ID. Supports comma-separated values.
      name: policy_id
    - auto: PREDEFINED
      description: Device target priority. Supports comma-separated values.
      name: target_priority
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      - MISSION_CRITICAL
    - defaultValue: '20'
      description: Maximum number of rows to return.
      name: limit
    - auto: PREDEFINED
      defaultValue: last_contact_time
      description: Sort Fields.
      name: sort_field
      predefined:
      - target_priority
      - policy_name
      - name
      - last_contact_time
      - av_pack_version
    - auto: PREDEFINED
      defaultValue: DESC
      description: Sort Order for field.
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: List devices based on the search query.
    name: cb-eedr-devices-list
    outputs:
    - contextPath: CarbonBlackEEDR.Device.sensor_out_of_date
      description: Is the device sensor out of date.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Device.vdi_base_device
      description: vdi base device.
      type: String
    - contextPath: CarbonBlackEEDR.Device.linux_kernel_version
      description: Linux kernel version.
      type: String
    - contextPath: CarbonBlackEEDR.Device.mac_address
      description: Device MAC address.
      type: String
    - contextPath: CarbonBlackEEDR.Device.os
      description: Device operating system.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_device_policy_changed_time
      description: Last device policy changed time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.last_reset_time
      description: Last reset time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.sensor_states
      description: Device sensor state.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_external_ip_address
      description: Last external IP address.
      type: String
    - contextPath: CarbonBlackEEDR.Device.organization_id
      description: Organization ID.
      type: Number
    - contextPath: CarbonBlackEEDR.Device.sensor_kit_type
      description: Sensor kit type.
      type: String
    - contextPath: CarbonBlackEEDR.Device.policy_id
      description: Device policy ID.
      type: Number
    - contextPath: CarbonBlackEEDR.Device.login_user_name
      description: Login user name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.deregistered_time
      description: Deregistered time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.registered_time
      description: Registered time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.name
      description: Device name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_device_policy_requested_time
      description: Last device policy requested time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.scan_last_complete_time
      description: Scan last complete time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.last_shutdown_time
      description: Last shutdown time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.scan_last_action_time
      description: Device scan last action time.
      type: String
    - contextPath: CarbonBlackEEDR.Device.windows_platform
      description: Windows platform.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_reported_time
      description: Device last reported time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.device_owner_id
      description: Device owner ID.
      type: Number
    - contextPath: CarbonBlackEEDR.Device.target_priority
      description: Target priority.
      type: String
    - contextPath: CarbonBlackEEDR.Device.status
      description: Device status.
      type: String
    - contextPath: CarbonBlackEEDR.Device.sensor_version
      description: Sensor version.
      type: String
    - contextPath: CarbonBlackEEDR.Device.virtual_machine
      description: Is the device virtual machine.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Device.last_name
      description: Last name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.scan_status
      description: Scan status.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_internal_ip_address
      description: Last internal IP address.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_policy_updated_time
      description: Last policy updated time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.last_contact_time
      description: Device last contact time.
      type: Date
    - contextPath: CarbonBlackEEDR.Device.quarantined
      description: Is the device quarantined.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Device.virtualization_provider
      description: Virtualization Provider.
      type: String
    - contextPath: CarbonBlackEEDR.Device.organization_name
      description: Organization Name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.ad_group_id
      description: Active directory group ID.
      type: String
    - contextPath: CarbonBlackEEDR.Device.policy_name
      description: Policy name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.policy_override
      description: Policy override.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Device.first_name
      description: First name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.current_sensor_policy_name
      description: Current sensor policy name.
      type: String
    - contextPath: CarbonBlackEEDR.Device.id
      description: Device ID.
      type: String
    - contextPath: CarbonBlackEEDR.Device.av_status
      description: av status.
      type: String
    - contextPath: CarbonBlackEEDR.Device.av_pack_version
      description: av pack version.
      type: String
    - contextPath: CarbonBlackEEDR.Device.email
      description: User email.
      type: String
    - contextPath: CarbonBlackEEDR.Device.os_version
      description: Device OS version.
      type: String
    - contextPath: CarbonBlackEEDR.Device.av_product_version
      description: AV product version.
      type: String
    - contextPath: CarbonBlackEEDR.Device.last_location
      description: Device last location.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retrieving the endpoint.
      type: String
    - contextPath: Endpoint.OS
      description: Endpoint OS.
      type: String
    - contextPath: Endpoint.OSVersion
      description: OS version.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The MAC address of the endpoint.
      type: String
  - arguments:
    - description: Alert minimum severity (In range of 1-10).
      name: minimum_severity
    - description: Device OS version. Supports comma-separated values.
      name: device_os_version
    - description: The policy ID. Supports comma-separated values.
      name: policy_id
    - description: Alert tags. Supports comma-separated values.
      name: alert_tag
    - description: Alert ID. Supports comma-separated values.
      name: alert_id
    - description: Device username. Supports comma-separated values.
      name: device_username
    - description: Device ID. Supports comma-separated values.
      name: device_id
    - description: Device OS. Supports comma-separated values.
      name: device_os
    - description: Process SHA256. Supports comma-separated values.
      name: process_sha256
    - description: Policy name. Supports comma-separated values.
      name: policy_name
    - description: Alert reputation. Supports comma-separated values.
      name: reputation
    - description: Alert type. Supports comma-separated values.
      name: alert_type
    - description: A comma-separated list of device names. Examples- "C:\\Users\\example_user\\Example" or  "/home/example_user/Example".
      name: device_name
    - description: A comma-separated list of process names. Examples- "C:\\Users\\example_user\\Example" or  "/home/example_user/Example".
      name: process_name
    - description: Field by which to sort the results.
      name: sort_field
      auto: PREDEFINED
      defaultValue: first_event_timestamp
      predefined:
      - first_event_timestamp
      - last_event_timestamp
    - description: How to order the results. Can be "ASC" (ascending) or "DESC" (descending).
      name: sort_order
      auto: PREDEFINED
      defaultValue: DESC
      predefined:
      - ASC
      - DESC
    - description: The maximum number of results to return.
      name: limit
      defaultValue: '10'
    - description: Alert start time.
      name: start_time
    - description: Alert end time.
      name: end_time
    description: Returns a list of alerts.
    name: cb-eedr-list-alerts
    outputs:
    - contextPath: CarbonBlackEEDR.Alert.threat_id
      description: Threat ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.first_event_time
      description: First event time.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.target_value
      description: Alert target value.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.reason
      description: Alert reason.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.org_key
      description: Organization key.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.device_id
      description: Device ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.report_id
      description: Report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.watchlists.id
      description: Watchlist ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.watchlists.name
      description: Watchlist name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.device_os_version
      description: Device OS version.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_threat_category
      description: Threat cause threat category.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.policy_id
      description: Policy ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_indicators.process_name
      description: Threat indicator - process name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_indicators.sha256
      description: Indicator SHA256 hash.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_sha256
      description: Threat cause actor SHA256.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.device_os
      description: Device OS.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.document_guid
      description: Document GUID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.create_time
      description: Alert create time.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_name
      description: Threat cause actor name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.ioc_hit
      description: IOC hit.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_reputation
      description: Threat cause reputation.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.legacy_alert_id
      description: Legacy alert ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.device_name
      description: Device name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.report_name
      description: Report name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.policy_name
      description: Policy name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.ioc_field
      description: IOC field.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.tags
      description: Alert tags.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.process_guid
      description: Process GUID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_actor_md5
      description: Threat cause actor MD5 hash.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.last_update_time
      description: Alert last updated time.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.type
      description: Alert type.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.id
      description: Alert ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.process_name
      description: Process name.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.last_event_time
      description: Alert last event time.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.ioc_id
      description: IOC ID.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.notes_present
      description: Whether notes are present.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Alert.run_state
      description: Alert run state.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.severity
      description: Alert severity.
      type: Number
    - contextPath: CarbonBlackEEDR.Alert.threat_cause_vector
      description: Threat cause vector.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.device_username
      description: Device username.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.workflow.changed_by
      description: Alert workflow - changed by.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.workflow.comment
      description: Alert workflow - comment.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.workflow.last_update_time
      description: Alert workflow - last updated time.
      type: Date
    - contextPath: CarbonBlackEEDR.Alert.workflow.remediation
      description: Alert workflow - remediation.
      type: String
    - contextPath: CarbonBlackEEDR.Alert.workflow.state
      description: Alert workflow state.
      type: String
  - description: Retrieves all watchlists.
    name: cb-eedr-watchlist-list
    outputs:
    - contextPath: CarbonBlackEEDR.Watchlist.classifier
      description: Watchlist classifier.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.last_update_timestamp
      description: Watchlist last updated timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.name
      description: Watchlist name.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.report_ids
      description: Watchlist report IDs.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.create_timestamp
      description: Watchlist created timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.id
      description: Watchlist ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.tags_enabled
      description: Whether tags are enabled for the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.description
      description: Watchlist description.
      type: String
    arguments: []
  - arguments:
    - description: The watchlist ID. Get the ID from the watchlist-list command.
      name: watchlist_id
      required: true
    description: Gets watchlist information by  watchlist ID.
    name: cb-eedr-get-watchlist-by-id
    outputs:
    - contextPath: CarbonBlackEEDR.Watchlist.classifier
      description: Watchlist classifier.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.last_update_timestamp
      description: Watchlist last updated timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.name
      description: Watchlist name.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.report_ids
      description: Watchlist report IDs.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.create_timestamp
      description: Watchlist created timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.id
      description: Watchlist ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.tags_enabled
      description: Whether tags are enabled for the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.description
      description: Watchlist description.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Aaerts_enabled
      description: Whether alerts are enabled for the watchlists.
      type: Boolean
  - arguments:
    - description: The watchlist ID. Get the ID from the watchlist-list command.
      name: watchlist_id
      required: true
    description: Retrieves the alert status for the watchlist with given watchlist ID.
    name: cb-eedr-watchlist-alerts-status
  - arguments:
    - description: The watchlist ID. Get the ID from the watchlist-list command.
      name: watchlist_id
      required: true
    description: Turns on alerts for the watchlist with the specified watchlist ID.
    name: cb-eedr-watchlist-alerts-enable
  - arguments:
    - description: The watchlist ID. Get the ID from the watchlist-list command.
      name: watchlist_id
      required: true
    description: Turns off alerts for the watchlist with the specified watchlist ID.
    name: cb-eedr-watchlist-alerts-disable
  - arguments:
    - description: The name of the watchlist.
      name: watchlist_name
      required: true
    - description: The watchlist description.
      name: description
    - auto: PREDEFINED
      description: Whether to enable watchlist tags. Can be "true" or "false".
      name: tags_enabled
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Enable watchlist alerts.
      name: alerts_enabled
      predefined:
      - 'true'
      - 'false'
    - description: The report IDs for creating the watchlist. Supports comma-separated values.
      name: report_ids
    - description: The classifier key for creating the watchlist.
      name: classifier_key
    - description: The classifier value for creating the watchlist.
      name: classifier_value
    description: Creates a new report or classifier watchlist.
    name: cb-eedr-watchlist-create
    outputs:
    - contextPath: CarbonBlackEEDR.Watchlist.Classifier
      description: The watchlist classifier.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Last_update_timestamp
      description: Watchlist last updated timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.Name
      description: Watchlist name.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Report_ids
      description: Watchlist report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Create_timestamp
      description: Watchlist created timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.Alerts_enabled
      description: Whether alerts are enabled in the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.ID
      description: Watchlist ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Tags_enabled
      description: Whether tags are enabled in the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.Description
      description: Watchlist description.
      type: String
  - arguments:
    - description: The watchlist ID to remove. Get the ID from the watchlist-list command.
      name: watchlist_id
      required: true
    description: Removes the specified watchlist.
    name: cb-eedr-watchlist-delete
  - arguments:
    - description: The watchlist ID to update.
      name: watchlist_id
      required: true
    - description: The watchlist name.
      name: watchlist_name
      required: true
    - description: Watchlist description.
      name: description
    - auto: PREDEFINED
      description: Whether to enable watchlist tags. Can be "true" or "false".
      name: tags_enabled
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Enable watchlist alerts.
      name: alerts_enabled
      predefined:
      - 'true'
      - 'false'
    - description: Watchlist report ID. Supports comma-separated values.
      name: report_ids
    - description: The classifier key to update.
      name: classifier_key
    - description: The classifier value to update.
      name: classifier_value
    description: Updates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist.
    name: cb-eedr-watchlist-update
    outputs:
    - contextPath: CarbonBlackEEDR.Watchlist.Classifier
      description: The watchlist classifier.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Last_update_timestamp
      description: Watchlist last update timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.Name
      description: Watchlist name.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Report_ids
      description: Watchlist report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Create_timestamp
      description: Watchlist created timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Watchlist.Alerts_enabled
      description: Whether alerts are enabled in the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.ID
      description: Watchlist ID.
      type: String
    - contextPath: CarbonBlackEEDR.Watchlist.Tags_enabled
      description: Whether tags are enabled in the watchlist.
      type: Boolean
    - contextPath: CarbonBlackEEDR.Watchlist.Description
      description: Watchlist description.
      type: String
  - arguments:
    - description: The report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    description: Retrieves the specified report.
    name: cb-eedr-report-get
    outputs:
    - contextPath: CarbonBlackEEDR.Report.Visibility
      description: Report visibility.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Title
      description: Report title.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Tags
      description: Report tags.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Link
      description: Report link.
      type: String
    - contextPath: CarbonBlackEEDR.Report.ID
      description: Report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Timestamp
      description: Report timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Report.Description
      description: Report description.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Severity
      description: Report severity.
      type: Number
    - contextPath: CarbonBlackEEDR.Report.IOCs
      description: The report's IOCs.
      type: String
  - arguments:
    - description: Report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    - description: IOC ID. Get the ID from get_report command.
      name: ioc_id
      required: true
    description: Gets the current ignore status for IOC ioc_id in report report_id.
    name: cb-eedr-ioc-ignore-status
  - arguments:
    - description: Report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    - description: IOC ID. Get the ID from get_report command.
      name: ioc_id
      required: true
    description: IOC ioc_id for report report_id will not match future events for any watchlist.
    name: cb-eedr-ioc-ignore
  - arguments:
    - description: Report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    - description: IOC ID. Get the ID from get_report command.
      name: ioc_id
      required: true
    description: IOC ioc_id for report report_id will match future events for all watchlists.
    name: cb-eedr-ioc-reactivate
  - arguments:
    - description: The report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    description: Report with report_id and all contained IOCs will not match future events for any watchlist.
    name: cb-eedr-report-ignore
  - arguments:
    - description: The report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    description: Report with report_id and all contained IOCs will match future events for all watchlists.
    name: cb-eedr-report-reactivate
  - arguments:
    - description: The report ID. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    description: Get current ignore status for report with report_id.
    name: cb-eedr-report-ignore-status
  - arguments:
    - description: The report ID to remove. Get the ID from the watchlist-list command.
      name: report_id
      required: true
    description: Remove report with report_id.
    name: cb-eedr-report-remove
  - arguments:
    - description: The report title.
      name: title
      required: true
    - description: The report description.
      name: description
      required: true
    - description: The report tags. Supports comma-separated values.
      name: tags
    - description: The report severity (In range of 1-10).
      name: severity
      required: true
    - description: IOCs of type IPv4. Supports comma-separated values.
      name: ipv4
    - description: 'The IOC query for the report, for example: (netconn_ipv4:2.2.2.2). Supports comma-separated values.'
      name: ioc_query
    - description: 'The report timestamp. For example: 2020-01-19T09:16:16.'
      name: timestamp
      required: true
    - description: IOCs of type IPv6. Supports comma-separated values.
      name: ipv6
    - description: IOCs of type MD5. Supports comma-separated values.
      name: md5
    - description: IOCs of type DNS. Supports comma-separated values.
      name: dns
    description: Adds a new watchlist report.
    name: cb-eedr-report-create
    outputs:
    - contextPath: CarbonBlackEEDR.Report.ID
      description: The report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Report.IOCs
      description: The report IOCs.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Link
      description: Report link.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Severity
      description: Report severity.
      type: Number
    - contextPath: CarbonBlackEEDR.Report.Timestamp
      description: The report timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Report.Title
      description: The report title.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Tags
      description: Report tags.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Visibility
      description: Report visibility.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Description
      description: The report description.
      type: String
  - arguments:
    - description: The report ID to update.
      name: report_id
      required: true
    - description: The report title.
      name: title
      required: true
    - description: The report description.
      name: description
      required: true
    - description: The report tags. Supports comma-separated values.
      name: tags
    - description: IOC of type IPv4. Supports comma-separated values.
      name: ipv4
    - description: IOC of type IPv6. Supports comma-separated values.
      name: ipv6
    - description: IOC of type DNS. Supports comma-separated values.
      name: dns
    - description: IOC of type MD5. Supports comma-separated values.
      name: md5
    - description: 'Query IOC. For example: (netconn_ipv4:2.2.2.2). Supports comma-separated values.'
      name: ioc_query
    - description: Report severity (In range of 1-10).
      name: severity
      required: true
    - description: The report timestamp.
      name: timestamp
      required: true
    description: Updates the specified report.
    name: cb-eedr-report-update
    outputs:
    - contextPath: CarbonBlackEEDR.Report.ID
      description: The report ID.
      type: String
    - contextPath: CarbonBlackEEDR.Report.IOCs
      description: The report IOC's.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Link
      description: Report link.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Severity
      description: Report severity.
      type: Number
    - contextPath: CarbonBlackEEDR.Report.Timestamp
      description: The report timestamp.
      type: Date
    - contextPath: CarbonBlackEEDR.Report.Title
      description: The report title.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Tags
      description: Report tags.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Visibility
      description: Report visibility.
      type: String
    - contextPath: CarbonBlackEEDR.Report.Description
      description: The report description.
      type: String
  - arguments:
    - description: The requested SHA256 hash to obtain information for.
      name: sha256
      required: true
    description: Gets an overview of the devices that executed the file.
    name: cb-eedr-file-device-summary
    outputs:
    - contextPath: CarbonBlackEEDR.File.first_seen_device_id
      description: The device ID of the device that first saw this file.
      type: Number
    - contextPath: CarbonBlackEEDR.File.first_seen_device_name
      description: The name of the device that first saw this file.
      type: String
    - contextPath: CarbonBlackEEDR.File.first_seen_device_timestamp
      description: The time that this file was first seen, for this organization.
      type: Date
    - contextPath: CarbonBlackEEDR.File.last_seen_device_id
      description: The device ID of the device that most recently saw this file.
      type: Number
    - contextPath: CarbonBlackEEDR.File.last_seen_device_name
      description: The name of the device that last saw this file.
      type: String
    - contextPath: CarbonBlackEEDR.File.last_seen_device_timestamp
      description: The time that this file was most recently seen for this organization.
      type: Date
    - contextPath: CarbonBlackEEDR.File.num_devices
      description: The total number of devices, for this organization, that have observed this file.
      type: Number
    - contextPath: CarbonBlackEEDR.File.sha256
      description: The SHA256 hash of the file.
      type: String
  - arguments:
    - description: The requested SHA256 hash to obtain metadata information.
      name: sha256
      required: true
    description: Returns all of the metadata for the specified binary identified by the SHA256 hash.
    name: cb-eedr-get-file-metadata
    outputs:
    - contextPath: CarbonBlackEEDR.File.file_size
      description: The size of the actual file. This is the size of the file represented by this hash.
      type: Number
    - contextPath: CarbonBlackEEDR.File.file_available
      description: If true, the file is available for download.
      type: Boolean
    - contextPath: CarbonBlackEEDR.File.sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: CarbonBlackEEDR.File.product_version
      description: Product version from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.product_description
      description: Product description from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.lang_id
      description: The Language ID value from the Windows VERSIONINFO resource.
      type: String
    - contextPath: CarbonBlackEEDR.File.company_name
      description: Company name from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.internal_name
      description: Internal name from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.charset_id
      description: The Character set ID value from the Windows VERSIONINFO resource.
      type: Number
    - contextPath: CarbonBlackEEDR.File.available_file_size
      description: The size of the file, that is available for download. If the file is unavailable the size will be zero.
      type: Number
    - contextPath: CarbonBlackEEDR.File.architecture
      description: 'The set of architectures that this file was compiled for. This may contain one or more of the following values: none, x86, amd64, and arm64.'
      type: String
    - contextPath: CarbonBlackEEDR.File.comments
      description: Comments from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.os_type
      description: 'The OS that this file is designed for. This may contain one or more of the following values: WINDOWS, ANDROID, MAC, IOS, LINUX, and OTHER.'
      type: String
    - contextPath: CarbonBlackEEDR.File.original_filename
      description: Original filename from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.file_version
      description: File version from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.file_description
      description: File description from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.product_name
      description: Product name from FileVersionInformation.
      type: String
    - contextPath: CarbonBlackEEDR.File.md5
      description: The MD5 hash of the file.
      type: String
  - arguments:
    - description: An array of SHA256 hashes (limit 100). Supports comma-separated values.
      name: sha256
      required: true
    - defaultValue: '300'
      description: The number of seconds to make the download URLs available for.
      name: expiration_seconds
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Download the file to XSOAR.
      name: download_to_xsoar
      predefined:
      - 'true'
      - 'false'
    description: The files are able to be downloaded via AWS S3 pre-signed URLs.
    name: cb-eedr-files-download-link-get
    outputs:
    - contextPath: CarbonBlackEEDR.File.found.sha256
      description: SHA256 hash of file that is available to be downloaded.
      type: String
    - contextPath: CarbonBlackEEDR.File.found.url
      description: An AWS S3 pre-signed URL for this file. Perform a GET on this URL to download the file.
      type: String
    - contextPath: CarbonBlackEEDR.File.not_found
      description: The SHA256 hashes that were not found.
      type: String
    - contextPath: CarbonBlackEEDR.File.error
      description: The SHA256 hashes that had an intermittent error.
      type: String
  - arguments:
    - description: The requested SHA256 hash to obtain information for. Supports comma-separated values.
      name: sha256
      required: true
    description: Return a summary of the observed file paths.
    name: cb-eedr-file-paths
    outputs:
    - contextPath: CarbonBlackEEDR.File.file_path_count
      description: The total number of unique file paths that have been observed, by this organization, for this file.
      type: Number
    - contextPath: CarbonBlackEEDR.File.file_paths
      description: The file path details.
      type: String
    - contextPath: CarbonBlackEEDR.File.sha256
      description: The SHA256 hash of the file.
      type: Unknown
    - contextPath: CarbonBlackEEDR.File.total_file_path_count
      description: The total number of file paths that have been observed, by this organization, for this file.
      type: Number
  - arguments:
    - description: The process name to search.
      isArray: true
      name: process_name
    - description: The process hash to search.
      isArray: true
      name: process_hash
    - description: The event ID to search.
      name: event_id
    - description: The maximum number of rows to return. Default is 20.
      name: limit
    - description: A free-style query. For example, "process_name:svchost.exe".
      name: query
    - description: First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago.
      name: start_time
    - description: Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time.
      name: end_time
    - description: Index of first records to fetch. Default is 0.
      name: start
    - description: Job ID to retrieve.
      name: job_id
      hidden: true
    - description: whether to run the command with polling.
      name: polling
      defaultValue: true
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: The time in seconds to wait between polling.
      name: interval_in_seconds
      defaultValue: '60'
    - description: The timeout duration in seconds for polling retries.
      name: time_out
      defaultValue: 600
    description: Creates a process search job and returns results if 'polling' argument is True.
    name: cb-eedr-process-search
    outputs:
    - contextPath: CarbonBlackEEDR.SearchProcess.job_id
      description: The ID of the job found by the search.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.status
      description: The status of the job found by the search.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_id
      description: The device ID that is guaranteed to be unique within each PSC environment.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username
      description: The user names related to the process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.backend_timestamp
      description: A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.childproc_count
      description: The cumulative count of child-process creations since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.crossproc_count
      description: The cumulative count of cross-process events since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_group_id
      description: The ID of the sensor group where the device belongs.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_name
      description: The name of the device.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_policy_id
      description: The ID of the policy applied to the device.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_timestamp
      description: The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched
      description: True if the process document came from the CBD data stream.
      type: Boolean
    - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched_event_type
      description: The CBD enriched event type.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.event_type
      description: 'The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL.'
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.filemod_count
      description: The cumulative count of file modifications since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.ingress_time
      description: Unknown.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.legacy
      description: True if the process document came from the legacy data stream (deprecated, use enriched).
      type: Boolean
    - contextPath: CarbonBlackEEDR.SearchProcess.results.modload_count
      description: The cumulative count of module loads since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.netconn_count
      description: The cumulative count of network connections since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.org_id
      description: The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_guid
      description: The process GUID of the parent process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_pid
      description: The PID of the parent process.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_guid
      description: Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based).
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_hash
      description: The MD5 and SHA-256 hashes of the process's main module in a multi-valued field.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_name
      description: The tokenized file path of the process's main module.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_pid
      description: The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username
      description: User names related to the process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.regmod_count
      description: The cumulative count of registry modifications since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.scriptload_count
      description: The cumulative count of loaded scripts since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.job_id
      description: The ID of the job found by the search.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.status
      description: The status of the job found by the search.
      type: String
    polling: true
  - arguments:
    - description: The process GUID to search. Must be focused on a single process.
      name: process_guid
    - auto: PREDEFINED
      description: The event type to search.
      name: event_type
      predefined:
      - filemod
      - netconn
      - regmod
      - modload
      - crossproc
      - childproc
    - description: The maximum number of rows to return. Default is 20.
      name: limit
    - description: A free-style query. For example, "process_name:svchost.exe".
      name: query
    - description: First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago.
      name: start_time
    - description: Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time.
      name: end_time
    - description: Index of first records to fetch. Default is 0.
      name: start
    description: Retrieves the events associated with a given process.
    name: cb-eedr-events-by-process-get
    outputs:
    - contextPath: CarbonBlackEEDR.SearchEvent.backend_timestamp
      description: The timestamp of when the process was ingested by the backend.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchEvent.created_timestamp
      description: The timestamp of when the event document was created.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchEvent.event_guid
      description: A globally unique identifier for this event document.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.event_hash
      description: ''
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.event_timestamp
      description: The timestamp of the event on the device.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchEvent.event_type
      description: 'The event type. Possible values are: filemod, netconn, regmod, modload, crossproc, and childproc.'
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.legacy
      description: True if this event comes from the CBD data stream.
      type: Boolean
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_action
      description: 'Action associated with the modload operation. The only possible value is: ACTION_LOAD_MODULE.'
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_effective_reputation
      description: ''
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_md5
      description: The MD5 hash for the modules loaded.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_name
      description: The modules loaded by this event.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_publisher
      description: The publisher that signed this module, if any.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_publisher_state
      description: 'The set of states associated with the publisher of the module. Can be a combination of: FILE_SIGNATURE_STATE_INVALID, FILE_SIGNATURE_STATE_SIGNED, FILE_SIGNATURE_STATE_VERIFIED, FILE_SIGNATURE_STATE_NOT_SIGNED, FILE_SIGNATURE_STATE_UNKNOWN, FILE_SIGNATURE_STATE_CHAINED, FILE_SIGNATURE_STATE_TRUSTED, FILE_SIGNATURE_STATE_OS, and FILE_SIGNATURE_STATE_CATALOG_SIGNED.'
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.modload_sha256
      description: The SHA256 hash for the modules loaded.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.process_guid
      description: The process GUID representing the process that this event belongs to.
      type: String
    - contextPath: CarbonBlackEEDR.SearchEvent.process_pid
      description: The PID of the process.
      type: Number
  - arguments:
    - description: The job ID to search.
      isArray: true
      name: job_id
      required: true
    description: Retrieves the process search results for a given job ID.
    name: cb-eedr-process-search-results
    outputs:
    - contextPath: CarbonBlackEEDR.SearchProcess.job_id
      description: The ID of the job found by the search.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.status
      description: The status of the job found by the search.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_id
      description: The device ID that is guaranteed to be unique within each PSC environment.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username
      description: The user names related to the process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.backend_timestamp
      description: A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.childproc_count
      description: The cumulative count of child-process creations since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.crossproc_count
      description: The cumulative count of cross-process events since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_group_id
      description: The ID of the sensor group where the device belongs.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_name
      description: The name of the device.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_policy_id
      description: The ID of the policy applied to the device.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.device_timestamp
      description: The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched
      description: True if the process document came from the CBD data stream.
      type: Boolean
    - contextPath: CarbonBlackEEDR.SearchProcess.results.enriched_event_type
      description: The CBD enriched event type.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.event_type
      description: 'The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL.'
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.filemod_count
      description: The cumulative count of file modifications since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.ingress_time
      description: Unknown.
      type: Date
    - contextPath: CarbonBlackEEDR.SearchProcess.results.legacy
      description: True if the process document came from the legacy data stream (deprecated, use enriched).
      type: Boolean
    - contextPath: CarbonBlackEEDR.SearchProcess.results.modload_count
      description: The cumulative count of module loads since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.netconn_count
      description: The cumulative count of network connections since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.org_id
      description: The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_guid
      description: The process GUID of the parent process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.parent_pid
      description: The PID of the parent process.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_guid
      description: Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based).
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_hash
      description: The MD5 and SHA-256 hashes of the process’s main module in a multi-valued field.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_name
      description: The tokenized file path of the process’s main module.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_pid
      description: The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.process_username
      description: User names related to the process.
      type: String
    - contextPath: CarbonBlackEEDR.SearchProcess.results.regmod_count
      description: The cumulative count of registry modifications since process tracking started.
      type: Number
    - contextPath: CarbonBlackEEDR.SearchProcess.results.scriptload_count
      description: The cumulative count of loaded scripts since process tracking started.
      type: Number
  - arguments:
    - description: Threat ID.
      name: threat_id
      required: true
    - description: Comma-separated list of tags.
      isArray: true
      name: tags
      required: true
    description: Update threat ID tags.
    name: cb-eedr-add-threat-tags
    outputs:
    - contextPath: CarbonBlackEEDR.Threat.ThreatID
      description: Threat ID.
    - contextPath: CarbonBlackEEDR.Threat.Tags
      description: Threat ID tags.
  - arguments:
    - description: Threat ID.
      name: threat_id
      required: true
    - description: Notes to be added to the provided threat ID.
      name: notes
      required: true
    description: Update threat ID notes.
    name: cb-eedr-add-threat-notes
    outputs:
    - contextPath: CarbonBlackEEDR.Threat.ThreatID
      description: Threat ID.
    - contextPath: CarbonBlackEEDR.Threat.Notes
      description: Threat ID notes.
  - arguments:
    - description: Alert ID to add the notes to.
      name: alert_id
      required: true
    - description: Notes to be added to the provided alert ID.
      name: notes
      required: true
    description: Update alert ID notes.
    name: cb-eedr-add-alert-notes
    outputs:
    - contextPath: CarbonBlackEEDR.Alert.AlertID
      description: The alert ID.
    - contextPath: CarbonBlackEEDR.Alert.Notes
      description: Alert notes.
  - arguments:
    - description: The threat ID for which we wish to get the tags.
      name: threat_id
      required: true
    description: Output a list of tags for the provided threat ID.
    name: cb-eedr-get-threat-tags
    outputs:
    - contextPath: CarbonBlackEEDR.Threat.ThreatID
      description: Threat ID.
    - contextPath: CarbonBlackEEDR.Threat.Tags
      description: Threat tags.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- Carbon Black Enterprise EDR Test
- Carbon Black Enterprise EDR process search with polling Test
- Carbon Black Enterprise EDR alert-workflow-update Test
fromversion: 5.0.0