commonfields:
  id: carbonblackliveresponse
  version: -1
name: carbonblackliveresponse
display: VMware Carbon Black EDR (Live Response API)
category: Endpoint
provider: Broadcom
description: Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).
configuration:
- display: Server URL
  name: serverurl
  defaultvalue: ""
  type: 0
  required: true
- display: API Token (CB Response)
  name: apitoken
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: API Token (CB Response)
  name: credentials_api_token
  hiddenusername: true
  type: 9
  required: false
- display: API Key (CB Defense)
  name: apikey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: API Key (CB Defense)
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
- display: Connector ID (CB Defense)
  name: connector
  defaultvalue: ""
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: cb-archive
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID to return the archive of.
    description: Archive the given session (If the session has no content it will fail)
  - name: cb-command-cancel
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID of command to cancel.
    - name: command
      required: true
      description: Command ID to cancel.
    outputs:
    - contextPath: CbLiveResponse.Commands.Status
      description: The Command Status.
    - contextPath: CbLiveResponse.Commands.Hostname
      description: The Hostname running the command.
    - contextPath: CbLiveResponse.Commands.CbSensorID
      description: The Sensor ID.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The Command name.
    - contextPath: CbLiveResponse.Commands.CbSessionID
      description: The Session ID.
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: The Command ID.
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: 'Object argument for the CbLive command - e.g. for ''directory list'' this is the path of the dir to list. Full docs: https://github.com/carbonblack/cbapi/tree/master/sensor_apis#command-objects'
    - contextPath: CbLiveResponse.Commands.CreateTime
      description: Command create time.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The time the command completed or 0 if still in progres.
    - contextPath: CbLiveResponse.Commands.Result.Desc
      description: Result description.
    - contextPath: CbLiveResponse.Commands.esult.Type
      description: Result type.
    - contextPath: CbLiveResponse.Commands.Result.Code
      description: Result code.
    description: Cancel the given command. Only pending commands can be canceled.
  - name: cb-command-info
    arguments:
    - name: session
      required: true
      description: Session ID of the command.
    - name: command
      required: true
      description: Command ID.
    description: Display information on command
  - name: cb-file-delete
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    - name: file-id
      required: true
      description: File ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Delete a given file in the session from Cb server.
  - name: cb-file-get
    arguments:
    - name: session
      required: true
      description: Session ID.
    - name: file-id
      required: true
      description: File ID.
    description: Download a file from Cb server in a given session.
    outputs:
    - contextPath: File.Size
      description: File size.
    - contextPath: File.SHA1
      description: File SHA1.
    - contextPath: File.SHA256
      description: File SHA256.
    - contextPath: File.Name
      description: File name.
    - contextPath: File.SSDeep
      description: File SSDeep.
    - contextPath: File.EntryID
      description: File EntryID.
    - contextPath: File.Info
      description: File info.
    - contextPath: File.Type
      description: File type.
    - contextPath: File.MD5
      description: File MD5.
    - contextPath: File.Extension
      description: File extension.
  - name: cb-file-info
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    - name: file-id
      description: File ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Get file info for a given file in a session
  - name: cb-file-upload
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID to upload the file through.
    - name: file-id
      required: true
      description: File entry id of an attachment to upload.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: Uploads the file to the Cb server. Use cb-push-file-to-endpoint instead.
  - name: cb-keepalive
    arguments:
    - name: session
      required: true
      default: true
      description: The session ID to keepalive.
    description: Keep the session alive to avoid closing due to timeout
  - name: cb-list-commands
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    description: List the CarbonBlack existing commands for a given session
  - name: cb-list-files
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID.
    outputs:
    - contextPath: CbLiveResponse.Files.Filename
      description: The Filename.
    - contextPath: CbLiveResponse.Files.Size
      description: The File size.
    - contextPath: CbLiveResponse.Files.CbFileID
      description: ID of the file within the Cb Session Storage - use with cb-get-file-from-endpoint.
    - contextPath: CbLiveResponse.Files.Status
      description: File status (0 if no error, another number otherwise).
    - contextPath: CbLiveResponse.Files.Delete
      description: Whether the file was deleted or not.
    description: List files in a given session
  - name: cb-list-sessions
    arguments:
    - name: sensor
      description: Sensor ID to filter sessions by.
    - name: status
      auto: PREDEFINED
      predefined:
      - active
      - pending
      - timeout
      - inactive
      - close
      description: 'Status to filter by (One of: active, pending, timeout, inactive, close).'
      isArray: true
    outputs:
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    description: List the CarbonBlack sessions
  - name: cb-session-close
    arguments:
    - name: session
      required: true
      description: The session ID to close.
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Close the given session
  - name: cb-session-create
    arguments:
    - name: sensor
      required: true
      default: true
      description: Sensor ID to create session for.
    - name: command-timeout
      description: Session timeout (If a command will not be issued after this time the session will be closed).
    - name: keepalive-timeout
      description: ' the timeout (in seconds) that a device should wait between commands. If no command is issued over this timeout the device will quit.'
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Create a new CarbonBlack session for a given sensor
  - name: cb-session-create-and-wait
    arguments:
    - name: sensor
      required: true
      default: true
      description: Sensor ID to create session for.
    - name: command-timeout
      description: Session timeout (If a command will not be issued after this time the session will be closed).
    - name: keepalive-timeout
      description: Session keepalive timeout (If a keepalive is not issued after this time, the session will close).
    - name: wait-timeout
      description: Time in seconds to wait for session to be active.
      defaultValue: "20"
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Create a new CarbonBlack session for a given sensor and wait for it to be active
  - name: cb-session-info
    arguments:
    - name: session
      required: true
      default: true
      description: Session ID to get info for.
    outputs:
    - contextPath: CbLiveResponse.Sessions.Status
      description: Session Status.
    - contextPath: CbLiveResponse.Sessions.Hostname
      description: Hostname.
    - contextPath: CbLiveResponse.Sessions.CbSensorID
      description: Sensor ID.
    - contextPath: CbLiveResponse.Sessions.CbSessionID
      description: Session ID.
    - contextPath: CbLiveResponse.Sessions.SessionTimeout
      description: Session Timeout.
    - contextPath: CbLiveResponse.Sessions.WaitTimeout
      description: Sensor wait timeout.
    description: Display session info
  - name: cb-process-kill
    arguments:
    - name: session
      description: 'Session ID. Provide the session ID to run the command with an existing session. '
    - name: pid
      required: true
      description: Process ID to terminate.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The process ID.
    description: Terminates a process at the sensor/endpoint
  - name: cb-directory-listing
    arguments:
    - name: session
      description: The session ID.
    - name: path
      required: true
      description: Path for the directory (e.g. "c:\\Users\\"). Note to end with double backslash.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.DirectoryList.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the directory listing filter (or path).
    - contextPath: CbLiveResponse.Commands.Files.FileAttributes
      description: List of file attributes.
    - contextPath: CbLiveResponse.Commands.Files.CreateTime
      description: Create time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.LastAccessTime
      description: Last access time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.LastWriteTime
      description: Last write time in unix time format.
    - contextPath: CbLiveResponse.Commands.Files.FileSize
      description: The file size.
    - contextPath: CbLiveResponse.Commands.Files.FileName
      description: The file name.
    description: List directories on the endpoint.
  - name: cb-process-execute
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: the path and command line of the executable.
    - name: wait
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: An optional parameter to specify whether to wait for the process to complete execution before reporting the result.
    - name: working-directory
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path and command line of the executable.
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: the return code of the process (if wait was set to “true”).
    - contextPath: CbLiveResponse.Commands.ProcessID
      description: The pid of the executed process.
    description: Run executable on the endpoint.
  - name: cb-memdeump
    deprecated: true
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The full path, including file name, to save the resulting memory dump on the endpoint (example - c:\\temp\\dump_file.dmp).
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path to save the resulting memory dump (on the endpoint).
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: Return code of the memory dump process.
    - contextPath: CbLiveResponse.Commands.CompressingEnabled
      description: Boolean flag indicating if compression is enabled.
    - contextPath: CbLiveResponse.Commands.Complete
      description: Boolean flag indicating if memory dump is completed.
    - contextPath: CbLiveResponse.Commands.PercentDone
      description: Percent of the process completed.
    - contextPath: CbLiveResponse.Commands.DumpingInProgress
      description: Boolean flag indicating if memory dump is in progress.
    description: Deprecated - use cb-memdump instead.
  - name: cb-command-create
    deprecated: true
    arguments:
    - name: name
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - put-file
      - get-file
      - delete-file
      - directory-list
      - reg-enum-key
      - reg-query-value
      - reg-create-key
      - reg-delete-key
      - reg-delete-value
      - reg-set-value
      - process-list
      - kill
      - create-process
      - memdump
      description: Command name.
    - name: timeout
      description: Command timeout.
    - name: object
      description: the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes.
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump ("true" or "false").
    - name: working-dir
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: value-data
      description: the data associated with the registry value.
    - name: value-type
      description: the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….)
    - name: overwrite
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is "false"). Can be "true" or "false".
    - name: offset
      description: a byte offset to start getting the file. Supports a partial get.
    - name: get-count
      description: the number of bytes to grab.
    - name: session
      required: true
      description: Session ID to create command for.
    outputs:
    - contextPath: CbLiveResponse.Commands.Status
      description: The Command Status.
    - contextPath: CbLiveResponse.Commands.Hostname
      description: The Hostname running the command.
    - contextPath: CbLiveResponse.Commands.CbLiveResponse.Commands.CbSensorID
      description: The Sensor ID.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The Command name.
    - contextPath: CbLiveResponse.Commands.CbSessionID
      description: The Session ID.
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: The Command ID.
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: 'Object argument for the CbLive command - e.g. for ''directory list'' this is the path of the dir to list. Full docs: https://github.com/carbonblack/cbapi/tree/master/sensor_apis#command-objects'
    - contextPath: CbLiveResponse.Commands.CreateTime
      description: Command create time.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The time the command completed or 0 if still in progres.
    - contextPath: CbLiveResponse.Commands.Result.Desc
      description: Result description.
    - contextPath: CbLiveResponse.Commands.Result.Type
      description: Result type.
    - contextPath: CbLiveResponse.Commands.Result.Code
      description: Result code.
    description: Create a live response command. Use cb-session-create instead.
  - name: cb-command-create-and-wait
    deprecated: true
    arguments:
    - name: name
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - put-file
      - get-file
      - delete-file
      - directory-list
      - reg-enum-key
      - reg-query-value
      - reg-create-key
      - reg-delete-key
      - reg-delete-value
      - reg-set-value
      - process-list
      - kill
      - create-process
      - memdump
      description: Command name.
    - name: timeout
      description: Command timeout.
    - name: object
      description: the object the command operates on. This is specific to the command but has meaning in a generic way for logging, and display purposes.
    - name: compress
      description: An optional parameter to specify whether to compress resulting memory dump ("true" or "false").
    - name: working-dir
      description: An optional parameter to specify the working directory of the executable.
    - name: output-file
      description: An option file that STDERR and STDOUT will be redirected to.
    - name: value-data
      description: the data associated with the registry value.
    - name: value-type
      description: the string representation of the registry value type (ie REG_DWORD, REG_QWORD, ….)
    - name: overwrite
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is "false"). Can be "true" or "false".
    - name: offset
      description: a byte offset to start getting the file. Supports a partial get.
    - name: get-count
      description: the number of bytes to grab.
    - name: session
      required: true
      description: Session ID to create command for.
    - name: wait-timeout
      description: Time to wait in seconds to wait for command to finish executing.
      defaultValue: "20"
    description: Create a live response command and wait for it to finish executing
  - name: cb-terminate-process
    deprecated: true
    arguments:
    - name: session
      required: true
      description: Session ID.
    - name: pid
      required: true
      description: Process ID to terminate.
    - name: wait-timeout
      description: Time to wait in seconds for process to complete termination.
      defaultValue: "20"
    description: Terminates a process at the sensor/endpoint
  - name: cb-file-delete-from-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The source path of the object to delete.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The source path of the object to delete.
    description: Delete a file from the endpoint.
  - name: cb-registry-get-values
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key to query.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path of the key to queried.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyType
      description: Registry value type.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyName
      description: the name of the registry value.
    - contextPath: CbLiveResponse.Commands.Values.RegKeyData
      description: The data associated with the registry value.
    - contextPath: CbLiveResponse.Commands.SubKeys
      description: List of subkey names.
    description: Enumerate registry values
  - name: cb-registry-query-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value (e.g. HKEY_LOCAL_MACHINE\blah\key\value).
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the path of the key + the path of the value (ie HKEY_LOCAL_MACHINE\blah\key\value).
    - contextPath: CbLiveResponse.Commands.Registry.QueryValue.Values.RegKeyType
      description: Registry value type.
    - contextPath: CbLiveResponse.Commands.RegKeyName
      description: the name of the registry value.
    - contextPath: CbLiveResponse.Commands.RegKeyData
      description: The data associated with the registry value.
    - contextPath: CbLiveResponse.Commands.SubKeys
      description: List of subkey names.
    description: Query for registry value.
  - name: cb-registry-create-key
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The key path to create.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Create a new registry key.
  - name: cb-registry-delete-key
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The key path to delete.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: the key path.
    description: Delete registry key.
  - name: cb-registry-delete-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Delete registry value.
  - name: cb-registry-set-value
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The path of the key + the path of the value.
    - name: data
      required: true
      description: The data to set for the value. Note if the value type ‘REG_MULTI_SZ’ then multiple values should be separated by a comma (e.g. value1, value2, value3).
    - name: type
      required: true
      description: One of common registry value types (REG_DWORD, REG_QWORD, REG_SZ etc).
    - name: overwrite
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: An optional parameter to specify whether to overwrite the value if it already exists (default value is ’no’).
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The key path.
    description: Set registry value.
  - name: cb-process-list
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Cancel the command if still 'pending' after timeout.
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.Processes.ProcessID
      description: Process ID.
    - contextPath: CbLiveResponse.Commands.Processes.CreateTime
      description: The creation time of the process in unix time.
    - contextPath: CbLiveResponse.Commands.Processes.ProcessGuid
      description: The process guid of the process.
    - contextPath: CbLiveResponse.Commands.Processes.Path
      description: The execution path of the process.
    - contextPath: CbLiveResponse.Commands.Processes.SecurityIdentifier
      description: The Security Identifier (SID) of the default process token.
    - contextPath: CbLiveResponse.Commands.Processes.Username
      description: The username of the default process token.
    - contextPath: CbLiveResponse.Commands.Processes.Parent
      description: The pid (process id ) of the parent.
    - contextPath: CbLiveResponse.Commands.Processes.ParentGuid
      description: The process guid of the parent process.
    description: 'List processes running on the endpoint. '
  - name: cb-get-file-from-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The source path of the file.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: download
      description: If "true" will download the file from the CarbonBlack server. Default is "true". Set to false for large files.
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The source path of the file.
    - contextPath: CbLiveResponse.Commands.FileID
      description: Unique file ID.
    - contextPath: CbLiveResponse.File.Size
      description: File size.
    - contextPath: CbLiveResponse.File.SHA1
      description: SHA1 hash.
    - contextPath: CbLiveResponse.File.SHA256
      description: SHA256 hash.
    - contextPath: CbLiveResponse.File.Name
      description: File name.
    - contextPath: CbLiveResponse.File.SSDeep
      description: SSDeep hash.
    - contextPath: CbLiveResponse.File.EntryID
      description: File EntryID.
    - contextPath: CbLiveResponse.File.Info
      description: File info.
    - contextPath: CbLiveResponse.File.Type
      description: File type.
    - contextPath: CbLiveResponse.File.MD5
      description: MD5 hash.
    - contextPath: CbLiveResponse.File.Extension
      description: File extension.
    description: |
      Retrieves a file from a path on the endpoint.
      For large files, set the "download" argument to "false". Verify that the command completed by using the !cb-command-info command.
      After the command completes, download the file using the !cb-file-get command.
  - name: cb-push-file-to-endpoint
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provided the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: entry-id
      required: true
      description: The file entry ID.
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from 'pending' to 'in-progress'/'complete').
      defaultValue: "20"
    - name: path
      required: true
      description: The destination path of the file. Include file name and type (e.g. "c:\\Users\\USER\\Desktop\\log.txt").
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command Status ('pending', 'in progress', 'complete', 'error', 'canceled').
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The destination path of the file.
    description: Save a file to a specific path on the endpoint.
  - name: cb-memdump
    arguments:
    - name: session
      description: The session ID.
    - name: sensor
      description: The sensor ID.  Provide the sensor ID to run the command with a new session. The session will be created and closed automatically.
    - name: path
      required: true
      description: The full path, including file name, to save the resulting memory dump on the endpoint, for example, c:\\temp\\dump_file.dmp).
    - name: compress
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to compress resulting memory dump. Can be "rue" or "false".
    - name: wait-timeout
      description: Time to wait (in seconds) for Cb command to be executed (change status from "pending" to "in-progress" or "complete").
    - name: cancel-on-timeout
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Whether to cancel the command if still in "pending" status after timeout. Can be "yes" or "no".
    outputs:
    - contextPath: CbLiveResponse.Commands.CbCommandID
      description: Unique command identifier.
    - contextPath: CbLiveResponse.Commands.CommandName
      description: The command name.
    - contextPath: CbLiveResponse.Commands.Status
      description: The command status.
    - contextPath: CbLiveResponse.Commands.CommandCompletionTime
      description: The command completion time (0 if not complete).
    - contextPath: CbLiveResponse.Commands.OperandObject
      description: The path to save the resulting memory dump (on the endpoint).
    - contextPath: CbLiveResponse.Commands.ReturnCode
      description: Return code of the memory dump process.
    - contextPath: CbLiveResponse.Commands.CompressingEnabled
      description: Whether compression is enabled.
      type: boolean
    - contextPath: CbLiveResponse.Commands.Complete
      description: Whether the memory dump completed.
      type: boolean
    - contextPath: CbLiveResponse.Commands.PercentDone
      description: Percent of the process completed.
    - contextPath: CbLiveResponse.Commands.DumpingInProgress
      description: Whether the memory dump is in progress.
      type: boolean
    description: Executes an endpoint memory dump.
tests:
- Carbon Black Live Response Test
fromversion: 5.0.0