VMware Carbon Black Enterprise EDR
Overview
VMware Carbon Black Enterprise EDR is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter)
Configure VMware Carbon Black Enterprise EDR on Demisto
- Navigate to Settings > Integrations > Servers & Services.
- Search for VMware Carbon Black Enterprise EDR.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g. https://defense.conferdeploy.net)
- Organization Key
- Custom Key
- Custom ID
- Fetch incidents
- Incident type
- Trust any certificate (not secure)
- Use system proxy settings
- First fetch timestamp (\<number> \<time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
- Fetch limit
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- cb-eedr-alert-workflow-update
- cb-eedr-device-quarantine
- cb-eedr-device-unquarantine
- cb-eedr-device-background-scan-stop
- cb-eedr-device-background-scan
- cb-eedr-device-bypass
- cb-eedr-device-unbypass
- cb-eedr-device-policy-update
- cb-eedr-devices-list
- cb-eedr-list-alerts
- cb-eedr-watchlist-list
- cb-eedr-get-watchlist-by-id
- cb-eedr-watchlist-alerts-status
- cb-eedr-watchlist-alerts-enable
- cb-eedr-watchlist-alerts-disable
- cb-eedr-watchlist-create
- cb-eedr-watchlist-delete
- cb-eedr-watchlist-update
- cb-eedr-report-get
- cb-eedr-ioc-ignore-status
- cb-eedr-ioc-ignore
- cb-eedr-ioc-reactivate
- cb-eedr-report-ignore
- cb-eedr-report-reactivate
- cb-eedr-report-ignore-status
- cb-eedr-report-remove
- cb-eedr-report-create
- cb-eedr-report-update
- cb-eedr-file-device-summary
- cb-eedr-get-file-metadata
- cb-eedr-files-download-link-get
- cb-eedr-file-paths
- cb-eedr-process-search
- cb-eedr-events-by-process-get
- cb-eedr-process-search-results
1. cb-eedr-alert-workflow-update
Updates the workflow of a single event.
Required Permissions
RBAC Permissions Required - org.alerts.dismiss: EXECUTE
Base Command
cb-eedr-alert-workflow-update
Input
Argument Name | Description | Required |
---|---|---|
alert_id | The ID of the alert to update. Get the ID from list_alerts command. | Required |
state | Workflow state to update. | Optional |
comment | Comment to include with the operation. | Optional |
remediation_state | Description of the changes done in the workflow state. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Alert.AlertID | String | The alert ID. |
CarbonBlackEEDR.Alert.ChangedBy | String | User that changed the ID. |
CarbonBlackEEDR.Alert.Comment | String | Comment that was included with the operation. |
CarbonBlackEEDR.Alert.LastUpdateTime | Date | Last time the alert was updated. |
CarbonBlackEEDR.Alert.Remediation | String | Description or justification for the change. |
CarbonBlackEEDR.Alert.State | String | The alert state. |
Command Example
!cb-eedr-alert-workflow-update alert_id=A28C720DCBCD66333A624893AB1E0FE9 state=open
Context Example
Human Readable Output
Successfully updated the alert: "A28C720DCBCD66333A624893AB1E0FE9"
changed_by | last_update_time | state |
---|---|---|
ATL5Y9DR4B | 2020-05-26T13:33:12.890Z | OPEN |
2. cb-eedr-device-quarantine
Quarantines a device.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cb-eedr-device-quarantine
Input
Argument Name | Description | Required |
---|---|---|
device_id | The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-quarantine device_id="1225783"
Human Readable Output
The device ['1225783'] has been quarantined successfully.
3. cb-eedr-device-unquarantine
Removes a device from quarantine.
Required Permissions
RBAC Permissions Required - device.quarantine: EXECUTE
Base Command
cb-eedr-device-unquarantine
Input
Argument Name | Description | Required |
---|---|---|
device_id | The devices on which to perform the action. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-unquarantine device_id="1225783"
Human Readable Output
The device ['1225783'] has been unquarantined successfully.
4. cb-eedr-device-background-scan-stop
Stops a background scan on the specified devices.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cb-eedr-device-background-scan-stop
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-background-scan-stop device_id="1225783"
Human Readable Output
The device ['1225783'] background scan has been disabled successfully.
5. cb-eedr-device-background-scan
Start a background scan on device.
Required Permissions
RBAC Permissions Required - device.bg-scan: EXECUTE
Base Command
cb-eedr-device-background-scan
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Get the ID from the devices-list command. Supports comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-background-scan device_id="1225783"
Human Readable Output
The device ['1225783'] background scan has been enabled successfully.
6. cb-eedr-device-bypass
Enable a bypass on device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cb-eedr-device-bypass
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-bypass device_id="1225783"
Human Readable Output
The device ['1225783'] bypass has been enabled successfully.
7. cb-eedr-device-unbypass
Disable a bypass on device.
Required Permissions
RBAC Permissions Required - device.bypass: EXECUTE
Base Command
cb-eedr-device-unbypass
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-unbypass device_id="1225783"
Human Readable Output
The device ['1225783'] bypass has been disabled successfully.
8. cb-eedr-device-policy-update
Update device policy.
Required Permissions
RBAC Permissions Required - device.policy: EXECUTE
Base Command
cb-eedr-device-policy-update
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Get the ID from the devices-list command. Support comma-separated values. | Required |
policy_id | The policy ID. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-device-policy-update device_id=1225783 policy_id=12064
Human Readable Output
The policy 12064 has been assigned to device ['1225783'] successfully.
9. cb-eedr-devices-list
List devices based on the search query.
Required Permissions
RBAC Permissions Required - device: READ
Base Command
cb-eedr-devices-list
Input
Argument Name | Description | Required |
---|---|---|
device_id | The device ID. Supports comma-separated values. | Optional |
status | The device status. Supports comma-separated values. | Optional |
device_os | Device operation system. Supports comma-separated values. | Optional |
start_time | Device start last contact time. For example: 2019-01-01T11:00:00.157Z | Optional |
end_time | Device end last contact time. For example: 2019-01-01T11:00:00.157Z | Optional |
ad_group_id | Active directory group ID. Supports comma-separated values | Optional |
policy_id | The policy ID. Supports comma-separated values. | Optional |
target_priority | Device target priority. Supports comma-separated values | Optional |
limit | Maximum number of rows to return | Optional |
sort_field | Sort Fields | Optional |
sort_order | Sort Order for field. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Device.sensor_out_of_date | Boolean | Is the device sensor out of date. |
CarbonBlackEEDR.Device.vdi_base_device | String | vdi base device. |
CarbonBlackEEDR.Device.linux_kernel_version | String | Linux kernel version. |
CarbonBlackEEDR.Device.mac_address | String | Device MAC address. |
CarbonBlackEEDR.Device.os | String | Device operating system. |
CarbonBlackEEDR.Device.last_device_policy_changed_time | Date | Last device policy changed time. |
CarbonBlackEEDR.Device.last_reset_time | Date | Last reset time. |
CarbonBlackEEDR.Device.sensor_states | String | Device sensor state. |
CarbonBlackEEDR.Device.last_external_ip_address | String | Last external IP address. |
CarbonBlackEEDR.Device.organization_id | Number | Organization ID. |
CarbonBlackEEDR.Device.sensor_kit_type | String | Sensor kit type. |
CarbonBlackEEDR.Device.policy_id | Number | Device policy ID. |
CarbonBlackEEDR.Device.login_user_name | String | Login user name. |
CarbonBlackEEDR.Device.deregistered_time | Date | Deregistered time. |
CarbonBlackEEDR.Device.registered_time | Date | Registered time. |
CarbonBlackEEDR.Device.name | String | Device name. |
CarbonBlackEEDR.Device.last_device_policy_requested_time | Date | Last device policy requested time. |
CarbonBlackEEDR.Device.scan_last_complete_time | Date | Scan last complete time. |
CarbonBlackEEDR.Device.last_shutdown_time | Date | Last shutdown time. |
CarbonBlackEEDR.Device.scan_last_action_time | String | Device scan last action time. |
CarbonBlackEEDR.Device.windows_platform | String | Windows platform. |
CarbonBlackEEDR.Device.last_reported_time | Date | Device last reported time. |
CarbonBlackEEDR.Device.device_owner_id | Number | Device owner ID. |
CarbonBlackEEDR.Device.target_priority | String | Target priority. |
CarbonBlackEEDR.Device.status | String | Device status. |
CarbonBlackEEDR.Device.sensor_version | String | Sensor version. |
CarbonBlackEEDR.Device.virtual_machine | Boolean | Is the device virtual machine |
CarbonBlackEEDR.Device.last_name | String | Last name. |
CarbonBlackEEDR.Device.scan_status | String | Scan status. |
CarbonBlackEEDR.Device.last_internal_ip_address | String | Last internal IP address. |
CarbonBlackEEDR.Device.last_policy_updated_time | Date | Last policy updated time. |
CarbonBlackEEDR.Device.last_contact_time | Date | Device last contact time. |
CarbonBlackEEDR.Device.quarantined | Boolean | Is the device quarantined. |
CarbonBlackEEDR.Device.virtualization_provider | String | Virtualization Provider. |
CarbonBlackEEDR.Device.organization_name | String | Organization Name. |
CarbonBlackEEDR.Device.ad_group_id | String | Active directory group ID. |
CarbonBlackEEDR.Device.policy_name | String | Policy name. |
CarbonBlackEEDR.Device.policy_override | Boolean | Policy override. |
CarbonBlackEEDR.Device.first_name | String | First name. |
CarbonBlackEEDR.Device.current_sensor_policy_name | String | Current sensor policy name. |
CarbonBlackEEDR.Device.id | String | Device ID. |
CarbonBlackEEDR.Device.av_status | String | av status. |
CarbonBlackEEDR.Device.av_pack_version | String | av pack version. |
CarbonBlackEEDR.Device.email | String | User email. |
CarbonBlackEEDR.Device.os_version | String | Device OS version. |
CarbonBlackEEDR.Device.av_product_version | String | AV product version. |
CarbonBlackEEDR.Device.last_location | String | Device last location. |
Endpoint.ID | String | The unique ID within the tool retrieving the endpoint. |
Endpoint.OS | String | Endpoint OS. |
Endpoint.OSVersion | String | OS version. |
Endpoint.MACAddress | String | The MAC address of the endpoint. |
Command Example
!cb-eedr-devices-list
Context Example
Human Readable Output
Devices list results
ID | LastContactTime | LastExternalIpAddress | LastInternalIpAddress | LastLocation | Name | OS | PolicyName | Quarantined | TargetPriority | status |
---|---|---|---|---|---|---|---|---|---|---|
1244290 | 2020-05-26T13:32:36.272Z | 2.2.2.2 | 3.3.3.3 | OFFSITE | DESKTOP-ABCND73 | WINDOWS | test | false | HIGH | REGISTERED |
127519 | 2020-05-26T13:32:36.257Z | 4.4.4.4 | 10.10.10.10 | OFFSITE | AGENT-PC | WINDOWS | Detection_Servers | false | HIGH | REGISTERED |
5425783 | 2020-05-26T13:32:23.788Z | 8.8.8.8 | 10.10.10.10 | OFFSITE | Alphab-Win10-VM-1 | WINDOWS | test | false | HIGH | REGISTERED |
10. cb-eedr-list-alerts
Returns a list of alerts.
Required Permissions
RBAC Permissions Required - org.alerts: READ
Base Command
cb-eedr-list-alerts
Input
Argument Name | Description | Required |
---|---|---|
group_results | Whether to group results. Can be "true" or "false". The default is "true". | Optional |
minimum_severity | Alert minimum severity. | Optional |
device_os_version | Device OS version. Supports comma-separated values. | Optional |
policy_id | The policy ID. Supports comma-separated values. | Optional |
alert_tag | Alert tags. Supports comma-separated values. | Optional |
alert_id | Alert ID. Supports comma-separated values. | Optional |
device_username | Device username. Supports comma-separated values. | Optional |
device_id | Device ID. Supports comma-separated values. | Optional |
device_os | Device OS. Supports comma-separated values. | Optional |
process_sha256 | Process SHA256. Supports comma-separated values. | Optional |
policy_name | Policy name. Supports comma-separated values. | Optional |
reputation | Alert reputation. Supports comma-separated values. | Optional |
alert_type | Alert type. Supports comma-separated values. | Optional |
alert_category | Alert category. Supports comma-separated values. | Optional |
workflow | Alert workflow. Supports comma-separated values. | Optional |
device_name | Device name. Supports comma-separated values. | Optional |
process_name | Process name. Supports comma-separated values. | Optional |
sort_field | Field by which to sort the results. Can be "first_event_time", "last_event_time", "severity", or "target_value". | Optional |
sort_order | How to order the results. Can be "ASC" (ascending) or "DESC" (descending). The default is "DESC". | Optional |
limit | The maximum number of results to return. The default is 10. | Optional |
start_time | Alert start time. | Optional |
end_time | Alert end time. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Alert.threat_id | String | Threat ID. |
CarbonBlackEEDR.Alert.first_event_time | Date | First event time. |
CarbonBlackEEDR.Alert.target_value | String | Alert target value. |
CarbonBlackEEDR.Alert.reason | String | Alert reason. |
CarbonBlackEEDR.Alert.org_key | String | Organization key. |
CarbonBlackEEDR.Alert.device_id | String | Device ID. |
CarbonBlackEEDR.Alert.report_id | String | Report ID. |
CarbonBlackEEDR.Alert.watchlists.id | String | Watchlist ID. |
CarbonBlackEEDR.Alert.watchlists.name | String | Watchlist name. |
CarbonBlackEEDR.Alert.device_os_version | String | Device OS version. |
CarbonBlackEEDR.Alert.threat_cause_threat_category | String | Threat cause threat category. |
CarbonBlackEEDR.Alert.policy_id | String | Policy ID. |
CarbonBlackEEDR.Alert.threat_indicators.process_name | String | Threat indicator - process name. |
CarbonBlackEEDR.Alert.threat_indicators.sha256 | String | Indicator SHA256 hash. |
CarbonBlackEEDR.Alert.threat_cause_actor_sha256 | String | Threat cause actor SHA256. |
CarbonBlackEEDR.Alert.device_os | String | Device OS. |
CarbonBlackEEDR.Alert.document_guid | String | Document GUID. |
CarbonBlackEEDR.Alert.create_time | Date | Alert create time. |
CarbonBlackEEDR.Alert.threat_cause_actor_name | String | Threat cause actor name. |
CarbonBlackEEDR.Alert.ioc_hit | String | IOC hit. |
CarbonBlackEEDR.Alert.threat_cause_reputation | String | Threat cause reputation. |
CarbonBlackEEDR.Alert.legacy_alert_id | String | Legacy alert ID. |
CarbonBlackEEDR.Alert.device_name | String | Device name. |
CarbonBlackEEDR.Alert.report_name | String | Report name. |
CarbonBlackEEDR.Alert.policy_name | String | Policy name. |
CarbonBlackEEDR.Alert.ioc_field | String | IOC field. |
CarbonBlackEEDR.Alert.tags | String | Alert tags. |
CarbonBlackEEDR.Alert.process_guid | String | Process GUID. |
CarbonBlackEEDR.Alert.threat_cause_actor_md5 | String | Threat cause actor MD5 hash. |
CarbonBlackEEDR.Alert.last_update_time | Date | Alert last updated time. |
CarbonBlackEEDR.Alert.type | String | Alert type. |
CarbonBlackEEDR.Alert.id | String | Alert ID. |
CarbonBlackEEDR.Alert.process_name | String | Process name. |
CarbonBlackEEDR.Alert.last_event_time | Date | Alert last event time. |
CarbonBlackEEDR.Alert.ioc_id | String | IOC ID. |
CarbonBlackEEDR.Alert.notes_present | Boolean | Whether notes are present. |
CarbonBlackEEDR.Alert.run_state | String | Alert run state. |
CarbonBlackEEDR.Alert.severity | Number | Alert severity. |
CarbonBlackEEDR.Alert.category | String | Alert category. |
CarbonBlackEEDR.Alert.threat_cause_vector | String | Threat cause vector. |
CarbonBlackEEDR.Alert.device_username | String | Device username. |
CarbonBlackEEDR.Alert.workflow.changed_by | String | Alert workflow - changed by. |
CarbonBlackEEDR.Alert.workflow.comment | String | Alert workflow - comment. |
CarbonBlackEEDR.Alert.workflow.last_update_time | Date | Alert workflow - last updated time. |
CarbonBlackEEDR.Alert.workflow.remediation | String | Alert workflow - remediation. |
CarbonBlackEEDR.Alert.workflow.state | String | Alert workflow - state |
Command Example
!cb-eedr-list-alerts
Context Example
Human Readable Output
Alerts list results
AlertID | CreateTime | DeviceID | DeviceName | DeviceOS | PolicyName | ProcessName | Type | WorkflowState |
---|---|---|---|---|---|---|---|---|
ED0C9E6AE0C0E631FABC7E145CE036A5 | 2020-05-13T13:31:15.024Z | 1234242 | DESKTOP-AB3H40D | WINDOWS | test1 | 067f1b8f1e0b2bfe286f5169e17834e8cf7f4123b8d97f28ea78995dc81b0e7b.exe | WATCHLIST | DISMISSED |
A28C720DCBCD77222A621233AB1E0FE9 | 2020-04-27T12:21:51.294Z | 3450646 | TESTERONAPPS-CBDEF-1 | WINDOWS | test | svchost.exe | WATCHLIST | OPEN |
11. cb-eedr-watchlist-list
Retrieves all watchlists.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-watchlist-list
Input
Argument Name | Description | Required |
---|
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Watchlist.classifier | String | Watchlist classifier. |
CarbonBlackEEDR.Watchlist.last_update_timestamp | Date | Watchlist last updated timestamp. |
CarbonBlackEEDR.Watchlist.name | String | Watchlist name. |
CarbonBlackEEDR.Watchlist.report_ids | String | Watchlist report IDs. |
CarbonBlackEEDR.Watchlist.create_timestamp | Date | Watchlist created timestamp. |
CarbonBlackEEDR.Watchlist.id | String | Watchlist ID. |
CarbonBlackEEDR.Watchlist.tags_enabled | Boolean | Whether tags are enabled for the watchlist. |
CarbonBlackEEDR.Watchlist.description | String | Watchlist description. |
Command Example
!cb-eedr-watchlist-list
Context Example
Human Readable Output
Carbon Black Enterprise EDR Watchlists
ID | Name | Description | create_timestamp | Alerts_enabled | Tags_enabled | Report_ids | Last_update_timestamp | Classifier |
---|---|---|---|---|---|---|---|---|
AjQoLZwJRYu4oPC22YpepQ | test watchlist2 | 2020-05-26T13:27:44.000Z | true | true | A59huyinQSmAr8t1a2hpg | 2020-05-26T13:27:44.000Z | ||
2Bge40iPRCachAa1oYqMkA | test watchlist | this is a test watchlist | 2020-05-13T14:39:43.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:39:43.000Z | |
AiyyP5o1T6ia2LGBIuZtg | test watchlist1 | this is a test watchlist | 2020-05-13T14:40:03.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:40:03.000Z | |
5xq2xyrKRTOMzt5V8SaJQ | test watchlist123 | this is a test watchlist | 2020-05-13T14:40:58.000Z | false | false | A59huyinQSmAr8t1a2hpg | 2020-05-13T14:40:58.000Z | |
MXzJPzWYRuuKBEsy0UXImA | Cigent Watchlist | 2020-01-16T21:07:58.000Z | true | true | MLRtPcpQGKFh5OE4BT3tQ-19d3af31-5dbd-4b9f-9b1d-e8ddca6af991 | 2020-01-28T18:19:14.000Z |
12. cb-eedr-get-watchlist-by-id
Gets watchlist information by watchlist ID.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-get-watchlist-by-id
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Watchlist.classifier | String | Watchlist classifier. |
CarbonBlackEEDR.Watchlist.last_update_timestamp | Date | Watchlist last updated timestamp. |
CarbonBlackEEDR.Watchlist.name | String | Watchlist name. |
CarbonBlackEEDR.Watchlist.report_ids | String | Watchlist report IDs. |
CarbonBlackEEDR.Watchlist.create_timestamp | Date | Watchlist created timestamp. |
CarbonBlackEEDR.Watchlist.id | String | Watchlist ID. |
CarbonBlackEEDR.Watchlist.tags_enabled | Boolean | Whether tags are enabled for the watchlist. |
CarbonBlackEEDR.Watchlist.description | String | Watchlist description. |
CarbonBlackEEDR.Watchlist.Aaerts_enabled | Boolean | Whether alerts are enabled for the watchlists. |
Command Example
!cb-eedr-get-watchlist-by-id watchlist_id="JI5wCDVTPGEgbWlDCoGgQ"
Context Example
Human Readable Output
Watchlist JI5wCDVTPGEgbWlDCoGgQ information
ID | Name | Description | create_timestamp | Alerts_enabled | Tags_enabled | Report_ids | Last_update_timestamp |
---|---|---|---|---|---|---|---|
JI5wCDVTPGEgbWlDCoGgQ | test watchlist1 | test description | 1970-01-19T03:38:34.000Z | true | false | A59huyinQSmAr8t1a2hpg | 1970-01-19T09:29:39.000Z |
13. cb-eedr-watchlist-alerts-status
Retrieves the alert status for the watchlist with given watchlist ID.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-watchlist-alerts-status
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-watchlist-alerts-status watchlist_id=AiyyP5o1T6ia2LGBIuZtg
Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert status is On
14. cb-eedr-watchlist-alerts-enable
Turns on alerts for the watchlist with the specified watchlist ID.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-watchlist-alerts-enable
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-watchlist-alerts-enable watchlist_id=AiyyP5o1T6ia2LABIuZtg
Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert was enabled successfully.
15. cb-eedr-watchlist-alerts-disable
Turns off alerts for the watchlist with the specified watchlist ID.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-watchlist-alerts-disable
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-watchlist-alerts-disable watchlist_id=AiyyP5o1T6ia2LABIuZtg
Human Readable Output
Watchlist AiyyP5o1T6ia2LABIuZtg alert was disabled successfully.
16. cb-eedr-watchlist-create
Creates a new report or classifier watchlist.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: CREATE
Base Command
cb-eedr-watchlist-create
Input
Argument Name | Description | Required |
---|---|---|
watchlist_name | The name of the watchlist. | Required |
description | The watchlist description. | Optional |
tags_enabled | Whether to enable watchlist tags. Can be "true" or "false". | Optional |
alerts_enabled | Enable watchlist alerts | Optional |
report_ids | The report IDs for creating the watchlist. Supports comma-separated values. | Optional |
classifier_key | The classifier key for creating the watchlist. | Optional |
classifier_value | The classifier value for creating the watchlist. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Watchlist.Classifier | String | The watchlist classifier. |
CarbonBlackEEDR.Watchlist.Last_update_timestamp | Date | Watchlist last updated timestamp. |
CarbonBlackEEDR.Watchlist.Name | String | Watchlist name. |
CarbonBlackEEDR.Watchlist.Report_ids | String | Watchlist report ID. |
CarbonBlackEEDR.Watchlist.Create_timestamp | Date | Watchlist created timestamp. |
CarbonBlackEEDR.Watchlist.Alerts_enabled | Boolean | Whether alerts are enabled in the watchlist. |
CarbonBlackEEDR.Watchlist.ID | String | Watchlist ID. |
CarbonBlackEEDR.Watchlist.Tags_enabled | Boolean | Whether tags are enabled in the watchlist. |
CarbonBlackEEDR.Watchlist.Description | String | Watchlist description. |
Command Example
!cb-eedr-watchlist-create watchlist_name="test watchlist3" alerts_enabled=false tags_enabled=false report_ids=A59huyinQSmAr8t1a2hpg
Context Example
Human Readable Output
The watchlist "test watchlist3" created successfully.
Name | ID | Create_timestamp | Tags_enabled | Alerts_enabled | Report_ids |
---|---|---|---|---|---|
test watchlist3 | Bz4PlP5RSiGLvekCLbC0A | 2020-05-26T13:33:19.000Z | true | true | A59huyinQSmAr8t1a2hpg |
17. cb-eedr-watchlist-delete
Removes the specified watchlist.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
Base Command
cb-eedr-watchlist-delete
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID to remove. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-watchlist-delete watchlist_id=AjQoLZwJRYu4oPC22YpepQ
Human Readable Output
The watchlist AjQoLZwJRYu4oPC22YpepQ was deleted successfully.
18. cb-eedr-watchlist-update
Updates the specified watchlist. This will update the tags and alert status as well as any reports or classifiers attached to the watchlist.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
Base Command
cb-eedr-watchlist-update
Input
Argument Name | Description | Required |
---|---|---|
watchlist_id | The watchlist ID to update. | Required |
watchlist_name | The watchlist name. | Optional |
description | Watchlist description. | Optional |
tags_enabled | Whether to enable watchlist tags. Can be "true" or "false". | Optional |
alerts_enabled | Enable watchlist alerts. | Optional |
report_ids | Watchlist report ID. Supports comma-separated values. | Optional |
classifier_key | The classifier key to update. | Optional |
classifier_value | The classifier value to update. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Watchlist.Classifier | String | The watchlist classifier. |
CarbonBlackEEDR.Watchlist.Last_update_timestamp | Date | Watchlist last update timestamp. |
CarbonBlackEEDR.Watchlist.Name | String | Watchlist name. |
CarbonBlackEEDR.Watchlist.Report_ids | String | Watchlist report ID. |
CarbonBlackEEDR.Watchlist.Create_timestamp | Date | Watchlist created timestamp. |
CarbonBlackEEDR.Watchlist.Alerts_enabled | Boolean | Whether alerts are enabled in the watchlist. |
CarbonBlackEEDR.Watchlist.ID | String | Watchlist ID. |
CarbonBlackEEDR.Watchlist.Tags_enabled | Boolean | Whether tags are enabled in the watchlist. |
CarbonBlackEEDR.Watchlist.Description | String | Watchlist description. |
Command Example
!cb-eedr-watchlist-update watchlist_id=2Bge40iPRCachAa1oYqMkA alerts_enabled=true watchlist_name="new name"
Context Example
Human Readable Output
The watchlist "2Bge40iPRCachAa1oYqMkA" was updated successfully.
Name | ID | Create_timestamp | Tags_enabled | Alerts_enabled |
---|---|---|---|---|
new name | 2Bge40iPRCachAa1oYqMkA | 2020-05-13T14:39:43.000Z | false | true |
19. cb-eedr-report-get
Retrieves the specified report.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-report-get
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID. Get the ID from the watchlist-list command. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
CarbonBlackEEDR.Report.Title | String | Report title. |
CarbonBlackEEDR.Report.Tags | String | Report tags. |
CarbonBlackEEDR.Report.Link | String | Report link. |
CarbonBlackEEDR.Report.ID | String | Report ID. |
CarbonBlackEEDR.Report.Timestamp | Date | Report timestamp. |
CarbonBlackEEDR.Report.Description | String | Report description. |
CarbonBlackEEDR.Report.Severity | Number | Report severity. |
CarbonBlackEEDR.Report.IOCs | String | The report's IOCs. |
Command Example
!cb-eedr-report-get report_id="A59huyinQSmAr8t1a2hpg"
Context Example
Human Readable Output
Report "A59huyinQSmAr8t1a2hpg" information
ID | Title | Timestamp | Severity | Tags |
---|---|---|---|---|
A59huyinQSmAr8t1a2hpg | badfile.exe.exe | 1970-01-19T06:40:07.000Z | 8 | SAMPLE |
The IOCs for the report
ID | Match_type | Values |
---|---|---|
860ececb-2a2e-4dc5-bdbd-f6f45657cf7c | query | (process_name:chrome.exe) |
f551ba63-0c7a-48ec-b12d-c4b2a9f4b922 | query | (process_name:chrome.exe) |
c86187e3-90e3-4fb0-a698-18112b294059 | query | (netconn_ipv4:2.2.2.2) |
46e11795-e7ee-4f8e-8ad8-44b1d2216e30 | query | (process_name:c\:\users\administrator\desktop\badfile.exe) |
20. cb-eedr-ioc-ignore-status
Gets the current ignore status for IOC ioc_id in report report_id.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-ioc-ignore-status
Input
Argument Name | Description | Required |
---|---|---|
report_id | Report ID. Get the ID from the watchlist-list command. | Required |
ioc_id | IOC ID. Get the ID from get_report command | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-ioc-ignore-status ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c status is false
21. cb-eedr-ioc-ignore
IOC ioc_id for report report_id will not match future events for any watchlist.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
Base Command
cb-eedr-ioc-ignore
Input
Argument Name | Description | Required |
---|---|---|
report_id | Report ID. Get the ID from the watchlist-list command. | Required |
ioc_id | IOC ID. Get the ID from get_report command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-ioc-ignore ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
The IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c for report A59huyinQSmAr8t1a2hpg will not match future events for any watchlist.
22. cb-eedr-ioc-reactivate
IOC ioc_id for report report_id will match future events for all watchlists.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
Base Command
cb-eedr-ioc-reactivate
Input
Argument Name | Description | Required |
---|---|---|
report_id | Report ID. Get the ID from the watchlist-list command. | Required |
ioc_id | IOC ID. Get the ID from get_report command | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-ioc-reactivate ioc_id=860ececb-2a2e-4dc5-bdbd-f6f45657cf7c report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
IOC 860ececb-2a2e-4dc5-bdbd-f6f45657cf7c for report A59huyinQSmAr8t1a2hpg will match future events for all watchlists.
23. cb-eedr-report-ignore
Report with report_id and all contained IOCs will not match future events for any watchlist.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
Base Command
cb-eedr-report-ignore
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-report-ignore report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
The report with report_id "A59huyinQSmAr8t1a2hpg" and all contained IOCs will not match future events for any watchlist.
24. cb-eedr-report-reactivate
Report with report_id and all contained IOCs will match future events for all watchlists.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
Base Command
cb-eedr-report-reactivate
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-report-reactivate report_id=qtcpqJwuRjaFZWjAT8zhqQ
Human Readable Output
Report with report_id "qtcpqJwuRjaFZWjAT8zhqQ" and all contained IOCs will match future events for all watchlists
25. cb-eedr-report-ignore-status
Get current ignore status for report with report_id.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: READ
Base Command
cb-eedr-report-ignore-status
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-report-ignore-status report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
ignore status for report with report_id "A59huyinQSmAr8t1a2hpg" is enabled.
26. cb-eedr-report-remove
Remove report with report_id.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: DELETE
Base Command
cb-eedr-report-remove
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID to remove. Get the ID from the watchlist-list command. | Required |
Context Output
There is no context output for this command.
Command Example
!cb-eedr-report-remove report_id=A59huyinQSmAr8t1a2hpg
Human Readable Output
The report "A59huyinQSmAr8t1a2hpg" was deleted successfully.
27. cb-eedr-report-create
Adds a new watchlist report.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: CREATE
Base Command
cb-eedr-report-create
Input
Argument Name | Description | Required |
---|---|---|
title | The report title. | Required |
description | The report description. | Required |
tags | The report tags. Supports comma-separated values. | Optional |
severity | The report severity (In range of 1-10). | Required |
ipv4 | IOCs of type IPv4. Supports comma-separated values. | Optional |
ioc_query | The IOC query for the report, for example: (netconn_ipv4:2.2.2.2). Supports comma-separated values. | Optional |
timestamp | The report timestamp. For example: 2020-01-19T09:16:16 | Required |
ipv6 | IOCs of type IPv6. Supports comma-separated values. | Optional |
md5 | IOCs of type MD5. Supports comma-separated values. | Optional |
dns | IOCs of type DNS. Supports comma-separated values. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Report.ID | String | The report ID. |
CarbonBlackEEDR.Report.IOCs | String | The report IOCs |
CarbonBlackEEDR.Report.Link | String | Report link. |
CarbonBlackEEDR.Report.Severity | Number | Report severity. |
CarbonBlackEEDR.Report.Timestamp | Date | The report timestamp. |
CarbonBlackEEDR.Report.Title | String | The report title. |
CarbonBlackEEDR.Report.Tags | String | Report tags. |
CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
CarbonBlackEEDR.Report.Description | String | The report description. |
Command Example
!cb-eedr-report-create title="Report test" description="Testing new report creation" tags="one,two,three" severity="5" ipv4="2.2.2.2,3.3.3.3" timestamp="2019-01-01T00:00:16"
Context Example
Human Readable Output
The report was created successfully.
ID | Title | Timestamp | Description | Severity | Tags |
---|---|---|---|---|---|
rbwEBRfnTUGB6LqTUcgWg | Report test | 1970-01-18T21:31:40.000Z | Testing new report creation | 5 | one,two,three |
The IOCs for the report
Field | ID | Match_type | Values |
---|---|---|---|
netconn_ipv4 | 56e85f3d538b0602b10e0b544c3f61ea | equality | 2.2.2.2,3.3.3.3 |
28. cb-eedr-report-update
Updates the specified report.
Required Permissions
RBAC Permissions Required - threathunter.watchlists: UPDATE
Base Command
cb-eedr-report-update
Input
Argument Name | Description | Required |
---|---|---|
report_id | The report ID to update. | Required |
title | The report title. | Required |
description | The report description. | Required |
tags | The report tags. Supports comma-separated values. | Optional |
ipv4 | IOC of type IPv4. Supports comma-separated values. | Optional |
ipv6 | IOC of type IPv6. Supports comma-separated values. | Optional |
dns | IOC of type DNS. Supports comma-separated values. | Optional |
md5 | IOC of type MD5. Supports comma-separated values. | Optional |
ioc_query | Query IOC. For example: (netconn_ipv4:2.2.2.2). Supports comma-separated values. | Optional |
severity | Report severity (In range of 1-10). | Required |
timestamp | The report timestamp. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.Report.ID | String | The report ID. |
CarbonBlackEEDR.Report.IOCs | String | The report IOC's |
CarbonBlackEEDR.Report.Link | String | Report link. |
CarbonBlackEEDR.Report.Severity | Number | Report severity. |
CarbonBlackEEDR.Report.Timestamp | Date | The report timestamp. |
CarbonBlackEEDR.Report.Title | String | The report title. |
CarbonBlackEEDR.Report.Tags | String | Report tags. |
CarbonBlackEEDR.Report.Visibility | String | Report visibility. |
CarbonBlackEEDR.Report.Description | String | The report description. |
Command Example
!cb-eedr-report-update description="new description" report_id=qtcpqJwuRjaFZWjAT8zhqQ severity=5 timestamp=2020-05-19T09:18:48 title="new title"
Context Example
Human Readable Output
The report was updated successfully.
ID | Title | Timestamp | Description | Severity |
---|---|---|---|---|
qtcpqJwuRjaFZWjAT8zhqQ | new title | 2473-10-23T21:08:00.000Z | new description | 5 |
The IOCs for the report
No entries.
29. cb-eedr-file-device-summary
Gets an overview of the devices that executed the file.
Required Permissions
RBAC Permissions Required - Ubs.org.sha256
Base Command
cb-eedr-file-device-summary
Input
Argument Name | Description | Required |
---|---|---|
sha256 | The requested SHA256 hash to obtain information for. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.File.first_seen_device_id | Number | The device ID of the device that first saw this file. |
CarbonBlackEEDR.File.first_seen_device_name | String | The name of the device that first saw this file. |
CarbonBlackEEDR.File.first_seen_device_timestamp | Date | The time that this file was first seen, for this organization. |
CarbonBlackEEDR.File.last_seen_device_id | Number | The device ID of the device that most recently saw this file. |
CarbonBlackEEDR.File.last_seen_device_name | String | The name of the device that last saw this file. |
CarbonBlackEEDR.File.last_seen_device_timestamp | Date | The time that this file was most recently seen for this organization. |
CarbonBlackEEDR.File.num_devices | Number | The total number of devices, for this organization, that have observed this file. |
CarbonBlackEEDR.File.sha256 | String | The SHA256 hash of the file. |
Command Example
!cb-eedr-file-device-summary sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa"
Context Example
Human Readable Output
The file device summary
first_seen_device_id | first_seen_device_name | first_seen_device_timestamp | last_seen_device_id | last_seen_device_name | last_seen_device_timestamp | num_devices | sha256 |
---|---|---|---|---|---|---|---|
1294302 | test732-PC | 2020-05-18T09:26:28.205254Z | 1246865 | testcorewin764 | 2020-05-21T06:59:07.866395Z | 3 | 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa |
30. cb-eedr-get-file-metadata
Returns all of the metadata for the specified binary identified by the SHA256 hash.
Required Permissions
RBAC Permissions Required - Ubs.org.sha256
Base Command
cb-eedr-get-file-metadata
Input
Argument Name | Description | Required |
---|---|---|
sha256 | The requested SHA256 hash to obtain metadata information. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.File.file_size | Number | The size of the actual file. This is the size of the file represented by this hash. |
CarbonBlackEEDR.File.file_available | Boolean | If true, the file is available for download. |
CarbonBlackEEDR.File.sha256 | String | The SHA256 hash of the file. |
CarbonBlackEEDR.File.product_version | String | Product version from FileVersionInformation. |
CarbonBlackEEDR.File.product_description | String | Product description from FileVersionInformation. |
CarbonBlackEEDR.File.lang_id | String | The Language ID value from the Windows VERSIONINFO resource. |
CarbonBlackEEDR.File.company_name | String | Company name from FileVersionInformation |
CarbonBlackEEDR.File.internal_name | String | Internal name from FileVersionInformation. |
CarbonBlackEEDR.File.charset_id | Number | The Character set ID value from the Windows VERSIONINFO resource. |
CarbonBlackEEDR.File.available_file_size | Number | The size of the file, that is available for download. If the file is unavailable the size will be zero. |
CarbonBlackEEDR.File.architecture | String | The set of architectures that this file was compiled for. This may contain one or more of the following values: none, x86, amd64, and arm64. |
CarbonBlackEEDR.File.comments | String | Comments from FileVersionInformation. |
CarbonBlackEEDR.File.os_type | String | The OS that this file is designed for. This may contain one or more of the following values: WINDOWS, ANDROID, MAC, IOS, LINUX, and OTHER |
CarbonBlackEEDR.File.original_filename | String | Original filename from FileVersionInformation. |
CarbonBlackEEDR.File.file_version | String | File version from FileVersionInformation. |
CarbonBlackEEDR.File.file_description | String | File description from FileVersionInformation. |
CarbonBlackEEDR.File.product_name | String | Product name from FileVersionInformation. |
CarbonBlackEEDR.File.md5 | String | The MD5 hash of the file. |
Command Example
!cb-eedr-get-file-metadata sha256=4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa
Context Example
Human Readable Output
The file metadata
SHA256 | comments | file_size | internal_name | original_filename | os_type |
---|---|---|---|---|---|
4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa | Portable | 745664 | test.exe | test.exe | WINDOWS |
31. cb-eedr-files-download-link-get
The files are able to be downloaded via AWS S3 pre-signed URLs.
Required Permissions
RBAC Permissions Required - Ubs.org.file
Base Command
cb-eedr-files-download-link-get
Input
Argument Name | Description | Required |
---|---|---|
sha256 | An array of SHA256 hashes (limit 100). Supports comma-separated values. | Required |
expiration_seconds | The number of seconds to make the download URLs available for. The default is 300. | Optional |
download_to_xsoar | Download the file to XSOAR. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.File.found.sha256 | String | SHA256 hash of file that is available to be downloaded |
CarbonBlackEEDR.File.found.url | String | An AWS S3 pre-signed URL for this file. Perform a GET on this URL to download the file. |
CarbonBlackEEDR.File.not_found | String | The SHA256 hashes that were not found. |
CarbonBlackEEDR.File.error | String | The SHA256 hashes that had an intermittent error. |
Command Example
!cb-eedr-files-download-link-get sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa" expiration_seconds="3600" download_to_xsoar="false"
Context Example
Human Readable Output
The file to download
32. cb-eedr-file-paths
Return a summary of the observed file paths
Required Permissions
RBAC Permissions Required - RBAC Permissions Required: READ
Base Command
cb-eedr-file-paths
Input
Argument Name | Description | Required |
---|---|---|
sha256 | The requested SHA256 hash to obtain information for. Supports comma-separated values. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.File.file_path_count | Number | The total number of unique file paths that have been observed, by this organization, for this file. |
CarbonBlackEEDR.File.file_paths | String | The file path details. |
CarbonBlackEEDR.File.sha256 | Unknown | The SHA256 hash of the file. |
CarbonBlackEEDR.File.total_file_path_count | Number | The total number of file paths that have been observed, by this organization, for this file. |
Command Example
!cb-eedr-file-paths sha256="4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa"
Context Example
Human Readable Output
The file path for the sha256
file_path_count | file_paths | sha256 | total_file_path_count |
---|---|---|---|
1 | {'count': 3, 'file_path': 'c:\program files\admin\test.exe', 'first_seen_timestamp': '2020-05-18T09:26:28.205254Z'} | 4a714d98ce40f5f1234c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa | 3 |
33. cb-eedr-process-search
Creates a process search job.
Required Permissions
RBAC Permissions Required - org.search.events: CREATE
Base Command
cb-eedr-process-search
Input
Argument Name | Description | Required |
---|---|---|
process_name | The process name to search. | Optional |
process_hash | The process hash to search. | Optional |
event_id | The event ID to search. | Optional |
limit | The maximum number of rows to return. Default is 20. | Optional |
query | A free-style query. For example, "process_name:svchost.exe". | Optional |
start_time | First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. | Optional |
end_time | Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. | Optional |
start | Index of first records to fetch. Default is 0. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.SearchProcess.job_id | String | The ID of the job found by the search. |
CarbonBlackEEDR.SearchProcess.status | String | The status of the job found by the search. |
Command Example
!cb-eedr-process-search process_name="vmtoolsd.exe" limit=10
Context Example
Human Readable Output
job_id is 633b7900-2b28-456d-add3-28e665525753.
34. cb-eedr-events-by-process-get
Retrieves the events associated with a given process.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cb-eedr-events-by-process-get
Input
Argument Name | Description | Required |
---|---|---|
process_guid | The process GUID to search. | Optional |
event_type | The event type to search. | Optional |
limit | The maximum number of rows to return. Default is 20. | Optional |
query | A free-style query. For example, "process_name:svchost.exe". | Optional |
start_time | First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is 1 day ago. | Optional |
end_time | Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is current time. | Optional |
start | Index of first records to fetch. Default is 0. | Optional |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.SearchEvent.backend_timestamp | Date | The timestamp of when the process was ingested by the backend. |
CarbonBlackEEDR.SearchEvent.created_timestamp | Date | The timestamp of when the event document was created. |
CarbonBlackEEDR.SearchEvent.event_guid | String | A globally unique identifier for this event document. |
CarbonBlackEEDR.SearchEvent.event_hash | String | |
CarbonBlackEEDR.SearchEvent.event_timestamp | Date | The timestamp of the event on the device. |
CarbonBlackEEDR.SearchEvent.event_type | String | The event type. Possible values are: filemod, netconn, regmod, modload, crossproc, and childproc. |
CarbonBlackEEDR.SearchEvent.legacy | Boolean | True if this event comes from the CBD data stream. |
CarbonBlackEEDR.SearchEvent.modload_action | String | Action associated with the modload operation. The only possible value is: ACTION_LOAD_MODULE. |
CarbonBlackEEDR.SearchEvent.modload_effective_reputation | String | |
CarbonBlackEEDR.SearchEvent.modload_md5 | String | The MD5 hash for the modules loaded. |
CarbonBlackEEDR.SearchEvent.modload_name | String | The modules loaded by this event. |
CarbonBlackEEDR.SearchEvent.modload_publisher | String | The publisher that signed this module, if any. |
CarbonBlackEEDR.SearchEvent.modload_publisher_state | String | The set of states associated with the publisher of the module. Can be a combination of: FILE_SIGNATURE_STATE_INVALID, FILE_SIGNATURE_STATE_SIGNED, FILE_SIGNATURE_STATE_VERIFIED, FILE_SIGNATURE_STATE_NOT_SIGNED, FILE_SIGNATURE_STATE_UNKNOWN, FILE_SIGNATURE_STATE_CHAINED, FILE_SIGNATURE_STATE_TRUSTED, FILE_SIGNATURE_STATE_OS, and FILE_SIGNATURE_STATE_CATALOG_SIGNED. |
CarbonBlackEEDR.SearchEvent.modload_sha256 | String | The SHA256 hash for the modules loaded. |
CarbonBlackEEDR.SearchEvent.process_guid | String | The process GUID representing the process that this event belongs to. |
CarbonBlackEEDR.SearchEvent.process_pid | Number | The PID of the process. |
Command Example
!cb-eedr-events-by-process-get process_guid="7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43" event_type="modload" start_time="1 month"
Context Example
Human Readable Output
Results Found.
backend_timestamp created_timestamp event_guid event_hash event_timestamp event_type legacy modload_action modload_effective_reputation modload_md5 modload_name modload_publisher modload_publisher_state modload_sha256 process_guid process_pid 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.503Z OCaEtLR1SRGcWgVUcoj2mA lQJi__dhQpGzdVwCmbdbjg 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_LOCAL_WHITE aae1f614bfe5e3e5cde18d1f928f5b12 c:\windows\system32\ctiuser.dll Carbon Black, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED81eb5f6fbf8d7566560f43f75ec30e5f0284cdee9b5c9df0d81281bda0db3d07 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z aAVFrvjPQ3Sea-kK6Kdbxw L8CCeipjQ7KtMQDiRwx8HA 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 2c7c14627cff3384c52e61d4dbd0ecc3 c:\windows\system32\version.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED41b4d85d84a86e41b948694b9b5f398a0d79f47629d6d969eb5b461d4f5d0347 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z AlKrjPvcSLav4Vq7zBuD2A k7Z5u-3_Siydt1DPvXW4dQ 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE f7c09099232987cbb965b9280c1dacf8 c:\program files\vmware\vmware tools\gmodule-2.0.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDd14560487312f487f94bfaed4fe9d0cfd5efbec1ac4ef44c26dd230800bc6b29 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z 0g6iOKO9S8GHIfFSOG5sBA TX8Ehlc2Qb2mbSl8ZtVmgg 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 26fc0a369a68d2a429e2ebe67b8dd1d8 c:\program files\vmware\vmware tools\gobject-2.0.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED9a914642e7e8e4e4ba004004b490c64453f13597cc43cb77a9e55d180c229f83 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z W_JoluvFTni9mPPHCvyxmg CvjnmQdWQqGhbsmkcPzJYA 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 9d9b1790cc6eeb76757b5042914b7289 c:\program files\vmware\vmware tools\intl.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED03eef80ad1d4b066c4842546ba52ccb911e84606a27f0ec7016d9f62c572846b 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z -XTVyKT5SkeJ0PvsnozF6A 114rbukXQKSzjhiVBEApPQ 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE a83fcd02a532a08386a5bcbb39a581c5 c:\program files\vmware\vmware tools\glib-2.0.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDff9bb3a84c807f8151d4956f895f672fa812765e931e9093f40caab0853bd120 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z junO0BiIT9imVAUSKCdB_A 9Sd5fEA8R9aOU7eYlY_97A 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 9f2b3fac3440db16e0c13473b551d12c c:\windows\system32\vcruntime140.dll Microsoft Corporation FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED27c51ff3dc2f4cf2b61bdf55fb60148ef0abb06c2feae188c30f1a63f9e29caa 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z PocoJ9OATG6Qr-3cirRciQ D8k62OqkQ9KiT0c5C1Ki0g 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 965eb822d0ef8fda78ccb1f41def093d c:\windows\system32\winmm.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDad43d686930eae0f57a55ee75d10bd1882747089a291371ffe1e131eb5f76938 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z ThWF8yD5R5usoFJM4x_VRw mk9Lj4O0TAq-enCNCKWBMA 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE e6450257ba3df5161684e4c73ebb8f92 c:\windows\system32\winmmbase.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED948f13fe144cd80f93565ded2ac2e96d000869bb2761538996d28942495cb1d7 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z PZXgTx_XStWA1DGUkPDJzw UVssy5LWSvyvFC0Isya8aQ 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 821236519995fdfb54b56bd9d7a60ba8 c:\program files\vmware\vmware tools\pcre.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED64388ee3beb0e69fd471b3c7eb5d4de8ae24b9ea0fdba51bc9c81c26be84e585 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z bmsH73bASGaRFpeo84Q5Kw 9Ri-_u68QjyV7UjSMeDAYw 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 40b92f37c0698cdc4cde8c0a75791c7e c:\program files\vmware\vmware tools\vmtools.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDbb8098f4627441f6a29c31757c45339c74b2712b92783173df9ab58d47ae3bfa 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z WeL1uj4FSI-n4rVA7UoXFw b2SKdGkNSNuw0eoZn9wK_g 2020-10-14T16:17:45.448Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE e202dd92848c5103c9abf8ecd22bc539 c:\windows\system32\fltlib.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED353f8d4e647a11f235f4262d913f7bac4c4f266eac4601ea416e861afd611912 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z Q6PB6SqURW6xliJdsEogag YPhofHOyQkKaMGEr1dX5cQ 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE b7be84c53e81dd0a64ee0845410bd6c7 c:\windows\system32\icmp.dll Microsoft Windows FILE_SIGNATURE_STATE_CATALOG_SIGNED,
FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED8ddd1ddce37c7e560570774de7ca1a1ecf7b32dfd0ba014f504fc6ae50388de6 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z jg_1LLAYT1KZx9SZUPQqeQ 5eb6xzwkTt2p5b-2-ELzog 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 3929147a2a34b0902152c7d0f241b02a c:\windows\system32\iphlpapi.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDad1c5309aa873f6a284eabe382812868e20c3d3d64197f3e6ef9d015ea060caa 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z LDC8YHy4RFuIZuejh202dQ zMI8yTZvRBWnBzcuyUU0bQ 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE da9647c845792371dd2f95e1ccc9a63a c:\windows\system32\sspicli.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDfe741d2f986b0b9557a90bdf0560f49cd17381d1094c42a91634aabe49f46a1e 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z Oq1ZHJ-lSYGWynDM12vIhQ HwnoQEtpSp-El_7fEmh4Lw 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 435009d1ddc0365bfa34b8c8d3f85286 c:\windows\system32\ntmarta.dll Microsoft Windows FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED2f94628f056fe65ea81351e134e59ece813fec5e8400c12d6dfa49defd126d01 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z UpxEQukRRmiX3EjI4kkYYg afxpRq5BT6WRdQyBWS4-kQ 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 3c9d22cae173ad19806b6a016cd4cc28 c:\windows\system32\uxtheme.dll Microsoft Windows FILE_SIGNATURE_STATE_CATALOG_SIGNED,
FILE_SIGNATURE_STATE_OS,
FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDd95e7d07ea46d7d2aefa01cd0a64cf266be26d40fa6be42f7cf60f6deb8fbaf3 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z NcXdQS34QJWySTn-04pakA 4ZyNSN7yRyeNNBRop-HMDw 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE 1f1fe19bc54c75e568646327f6d99c1a c:\windows\system32\vsocklib.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIEDe685439d50aecf656ef5bd2523568b6d9220cc9917e7d57eda962c1a520e94a5 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z POYLqKCERASiTMBHcfsFmw UAoluLSYSKe2pzn47rxVDw 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE b56c118a906a0322b9319d50df188bc6 c:\program files\vmware\vmware tools\plugins\common\hgfsserver.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED0d74d8f4cf24bc72042234fb92b42396f6d2f6f77c534f9a07af3d82822a0452 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 2020-10-14T16:22:13.180Z 2020-11-04T06:58:51.505Z x2Beg9ykSIiRKViJJxcsaA 6xUCWyDQTAuOm7Lnxq-qew 2020-10-14T16:17:45.463Z modload false ACTION_LOADED_MODULE_DISCOVERED REP_WHITE a381226b5a088a07680391b94c474baa c:\program files\vmware\vmware tools\hgfs.dll VMware, Inc. FILE_SIGNATURE_STATE_SIGNED,
FILE_SIGNATURE_STATE_TRUSTED,
FILE_SIGNATURE_STATE_VERIFIED429a69aba0196be3f53ffa1d2dd09b0caea6fc680468706b2a20fa0f7188ad4b 7DESJ9GN-0034d5f2-00001f78-00000000-1d68709f411ee43 8056 Total of 2120 items found. Showing items 0 - 19.
35. cb-eedr-process-search-results
Retrieves the process search results for a given job ID.
Required Permissions
RBAC Permissions Required - org.search.events: READ
Base Command
cb-eedr-process-search-results
Input
Argument Name | Description | Required |
---|---|---|
job_id | The job ID to search. | Required |
Context Output
Path | Type | Description |
---|---|---|
CarbonBlackEEDR.SearchProcess.job_id | String | The ID of the job found by the search. |
CarbonBlackEEDR.SearchProcess.status | String | The status of the job found by the search. |
CarbonBlackEEDR.SearchProcess.results.device_id | Number | The device ID that is guaranteed to be unique within each PSC environment. |
CarbonBlackEEDR.SearchProcess.results.process_username | String | The user names related to the process. |
CarbonBlackEEDR.SearchProcess.results.backend_timestamp | Date | A date/time field formatted as an ISO-8601 string based on the UTC timezone. For example, device_timestamp:2018-03-14T21:06:45.183Z. |
CarbonBlackEEDR.SearchProcess.results.childproc_count | Number | The cumulative count of child-process creations since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.crossproc_count | Number | The cumulative count of cross-process events since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.device_group_id | Number | The ID of the sensor group where the device belongs. |
CarbonBlackEEDR.SearchProcess.results.device_name | String | The name of the device. |
CarbonBlackEEDR.SearchProcess.results.device_policy_id | Number | The ID of the policy applied to the device. |
CarbonBlackEEDR.SearchProcess.results.device_timestamp | Date | The time displayed on the sensor based on the sensor’s clock. The time is an ISO-8601 formatted time string based on the UTC timezone. |
CarbonBlackEEDR.SearchProcess.results.enriched | Boolean | True if the process document came from the CBD data stream. |
CarbonBlackEEDR.SearchProcess.results.enriched_event_type | String | The CBD enriched event type. |
CarbonBlackEEDR.SearchProcess.results.event_type | String | The CBD event type (valid only for events coming through analytics). Possible values are: CREATE_PROCESS, DATA_ACCESS, FILE_CREATE, INJECT_CODE, NETWORK, POLICY_ACTION, REGISTRY_ACCESS, and SYSTEM_API_CALL. |
CarbonBlackEEDR.SearchProcess.results.filemod_count | Number | The cumulative count of file modifications since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.ingress_time | Date | Unknown |
CarbonBlackEEDR.SearchProcess.results.legacy | Boolean | True if the process document came from the legacy data stream (deprecated, use enriched). |
CarbonBlackEEDR.SearchProcess.results.modload_count | Number | The cumulative count of module loads since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.netconn_count | Number | The cumulative count of network connections since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.org_id | String | The globally unique organization key. This will most likely be the PSC organization ID + PSC environment ID or some other unique token used across environments. |
CarbonBlackEEDR.SearchProcess.results.parent_guid | String | The process GUID of the parent process. |
CarbonBlackEEDR.SearchProcess.results.parent_pid | Number | The PID of the parent process. |
CarbonBlackEEDR.SearchProcess.results.process_guid | String | Unique ID of the solr document. Appears as process_guid + server-side timestamp in epoch ms (1/1/1970 based). |
CarbonBlackEEDR.SearchProcess.results.process_hash | String | The MD5 and SHA-256 hashes of the process’s main module in a multi-valued field. |
CarbonBlackEEDR.SearchProcess.results.process_name | String | The tokenized file path of the process’s main module. |
CarbonBlackEEDR.SearchProcess.results.process_pid | Number | The PID of a process. Can be multi-valued in case of exec/fork on Linux/OSX. |
CarbonBlackEEDR.SearchProcess.results.process_username | String | User names related to the process. |
CarbonBlackEEDR.SearchProcess.results.regmod_count | Number | The cumulative count of registry modifications since process tracking started. |
CarbonBlackEEDR.SearchProcess.results.scriptload_count | Number | The cumulative count of loaded scripts since process tracking started. |
Command Example
!cb-eedr-process-search-results job_id="99aad740-3903-4148-a5e7-7b5648794862"
Context Example
Human Readable Output
Completed Search Results:
process_hash process_name device_name device_timestamp process_pid process_username 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe cbcloud-win10 2020-10-28T07:20:07.603Z 2912 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-027 2020-10-27T14:47:13.760Z 3060 NT AUTHORITY\SYSTEM 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-004 2020-10-24T00:57:37.097Z 3188 63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6,
c7084336325dc8eadfb1e8ff876921c4c:\program files\vmware\vmware tools\vmtoolsd.exe win10etchangeme 2020-10-17T14:12:28.438Z 2956 NT AUTHORITY\SYSTEM 63d423ea882264dbb157a965c200306212fc5e1c6ddb8cbbb0f1d3b51ecd82e6,
c7084336325dc8eadfb1e8ff876921c4c:\program files\vmware\vmware tools\vmtoolsd.exe exapil\pil-cb7-2 2020-10-16T00:35:55.328Z 1576 NT AUTHORITY\SYSTEM 1169495860abe1bc6a498d2c196787c3,
fe6a1e46897b972a4f998d9792faccb3c292f9651fc9f744f1369e74667bf0f9c:\program files\vmware\vmware tools\vmtoolsd.exe hw-host-004 2020-10-05T02:16:18.531Z 2748 NT AUTHORITY\SYSTEM aca121d48147ff717bcd1da7871a5a76,
da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19adc:\program files\vmware\vmware tools\vmtoolsd.exe desktop-fvb88fs 2020-09-03T10:59:48.345Z 2892 NT AUTHORITY\SYSTEM aca121d48147ff717bcd1da7871a5a76,
da7e37ce59685964a3876ef1747964de1caabd13b3691b6a1d5ebed1d19c19adc:\program files\vmware\vmware tools\vmtoolsd.exe desktop-fvb88fs 2020-09-03T08:00:46.548Z 2892 NT AUTHORITY\SYSTEM 80abd555c1869baaff2d8a8d535ce07e,
fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504c:\program files\vmware\vmware tools\vmtoolsd.exe desktop-aa2m6ld 2020-08-26T16:06:50.813Z 2016 DESKTOP-AA2M6LD\John Doe 80abd555c1869baaff2d8a8d535ce07e,
fa353f142361e5c6ca57a66dcb341bba20392f5c29d2c113c7d62a216b0e0504c:\program files\vmware\vmware tools\vmtoolsd.exe desktop-aa2m6ld 2020-08-17T14:37:19.963Z 8052 DESKTOP-AA2M6LD\John Doe