VMware Carbon Black EDR (Deprecated)

This Integration is part of the Carbon Black Enterprise Response Pack.

Deprecated

Use VMware Carbon Black EDR v2 instead.

Deprecated. Use VMware Carbon Black EDR v2 instead. Query and response with Carbon Black endpoint detection and response.

This integration was integrated and tested with version 6.2.0 of Carbon Black Response

Configure carbonblack-v2 in Cortex

Parameter	Required
Server URL	True
API Token	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Fetch incidents	False
Incident type	False
Fetch Alert Severity Threshold Higher Than	False
Maximum Number Of Incidents To Fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

cb-alert

---

Retrieve alerts from Carbon Black Response.

Base Command

cb-alert

Input

Argument Name	Description	Required
status	Alert status to filter by. Possible values are: Unresolved, In Progress, Resolved, False Positive.	Optional
username	Alert username to filter by.	Optional
feedname	Alert feedname to filter by.	Optional
hostname	Alert hostname to filter by.	Optional
report	Alert report name (watchlist_id) to filter by.	Optional
query	Query string. Accepts the same data as the search box on the Binary Search page. See https://github.com/carbonblack/cbapi/blob/master/client_apis/docs/query_overview.pdf.	Optional
rows	Return this many rows, 10 by default.	Optional
start	Start at this row, 0 by default.	Optional
sort	Sort rows by this field and order. server_added_timestamp desc by default.	Optional
facet	Return facet results. 'false' by default, set to 'true' for facets.	Optional

Context Output

Path	Type	Description
CbResponse.Alerts.CbAlertID	unknown	Alert unique id
CbResponse.Alerts.ProcessPath	string	Alert Process Path
CbResponse.Alerts.Hostname	string	Alert Hostname
CbResponse.Alerts.InterfaceIP	string	Alert interface IP
CbResponse.Alerts.CommsIP	string	Communications IP
CbResponse.Alerts.MD5	string	Alert process MD5
CbResponse.Alerts.Description	unknown	Alert description
CbResponse.Alerts.FeedName	unknown	Alert feed name
CbResponse.Alerts.Severity	unknown	Alert severity
CbResponse.Alerts.Time	unknown	Alert created time
CbResponse.Alerts.Status	unknown	Alert status. One of: Unresolved, Resolved, False Positive

Command Example

Human Readable Output

cb-binary

---

Query for binaries based on given parameters

Base Command

cb-binary

Input

Argument Name	Description	Required
digital-signature	Whether digital signature is signed or not. Possible values are: Signed, Unsigned.	Optional
publisher	Filter binary by publisher.	Optional
company-name	Filter binary by company name.	Optional
product-name	Filter binary by product name.	Optional
filepath	Filter binary by file path.	Optional
group	Filter binary by group.	Optional
hostname	Filter binary by hostname.	Optional
query	Query string. Accepts the same data as the search box on the Binary Search page. See https://github.com/carbonblack/cbapi/blob/master/client_apis/docs/query_overview.pdf.	Optional
rows	Return this many rows, 10 by default.	Optional
start	Start at this row, 0 by default.	Optional
sort	Sort rows by this field and order. server_added_timestamp desc by default.	Optional
facet	Return facet results. 'false' by default, set to 'true' for facets.	Optional

Context Output

Path	Type	Description
File.DigSig.Publisher	unknown	The publisher of the Digital Signature
File.InternalName	unknown	The Internal Name
File.ServerAddedTimestamp	unknown	The server added timestamp
File.Name	unknown	Binary Name
File.Extension	unknown	Binary Extension
File.Timestamp	unknown	Binary Timestamp
File.Hostname	unknown	Binary Hostname
File.Description	unknown	The description
File.DigSig.Result	unknown	Cb's decision after checking this binary's Digital Signature
File.LastSeen	unknown	Last time binary was seen
File.Path	unknown	Binary Path
File.ProductName	unknown	The Product Name
File.OS	unknown	The OS
File.MD5	unknown	Binary MD5
File.Company	string	Name of the company that released a binary
File.DigitalSignature.Publisher	string	Publisher of the digital signature for the file.
File.Name	string	Full Filename e.g. data.xls.
File.Signature.OriginalName	string	File's original name.
File.Signature.InternalName	string	File's internal name.
File.Signature.FileVersion	string	File version.
File.Signature.Description	string	Description of the signature.

Command Example

Human Readable Output

cb-block-hash

---

Blocking hash

Base Command

cb-block-hash

Input

Argument Name	Description	Required
md5hash	the blacklisted hash.	Required
text	text description of block list.	Required
lastBanTime	the last time the hash was blocked or prevented from being executed.	Optional
banCount	total number of blocks on this block list.	Optional
lastBanHost	last hostname to block this hash.	Optional

Context Output

Path	Type	Description
File.LastAction	unknown	Last action taken on this file

Command Example

Human Readable Output

cb-get-hash-blacklist

---

Returns a list of hashes on block list, with each list entry describing one hash on block list.

Base Command

cb-get-hash-blacklist

Input

Argument Name	Description	Required
filter	OPTIONAL filters blacklist by fields. Example: filter="md5hash == put_your_hash_here".	Optional

Context Output

Path	Type	Description
CbResponse.BlockedHashes.MD5	unknown	Blocked MD5
CbResponse.BlockedHashes.Enabled	unknown	Is Enabled
CbResponse.BlockedHashes.Description	unknown	Blocked Description
CbResponse.BlockedHashes.Timestamp	unknown	Blocked Timestamp
CbResponse.BlockedHashes.BlockCount	unknown	Blocked Count
CbResponse.BlockedHashes.Username	unknown	Blocked hash username
CbResponse.BlockedHashes.LastBlock.Time	unknown	Last block time
CbResponse.BlockedHashes.LastBlock.Hostname	unknown	Last block hostname
CbResponse.BlockedHashes.LastBlock.CbSensorID	unknown	Last block sensor ID

Command Example

Human Readable Output

cb-get-process

---

Gets basic process information for segment (segment_id) of process (process_id)

Base Command

cb-get-process

Input

Argument Name	Description	Required
pid	the internal CB process id; this is the id field in search results.	Required
segid	the process segment id, the segment_id field in search results.	Required
get_related	If set to true, will get process siblings, parent and children. Possible values are: false, true. Default is false.	Optional

Context Output

Path	Type	Description
Process.Siblings.MD5	unknown	The sibling Process MD5
Process.CbSegmentID	unknown	Cb 'segment' where this process instance is stored. Required to fetch further info on a process.
Process.Parent.MD5	unknown	The parent Process MD5
Process.Children.CommandLine	unknown	The children Process CommandLine
Process.Hostname	unknown	Process Hostname
Process.Parent.CbSegmentID	unknown	The parent Cb 'segment' where this process instance is stored. Required to fetch further info on a process.
Process.CbID	unknown	Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.Siblings.CbSegmentID	unknown	The sibling Cb 'segment' where this process instance is stored. Required to fetch further info on a process.
Process.Children.Name	unknown	The children Process Name
Process.Parent.Name	unknown	The parent Process Name
Process.Siblings.Hostname	unknown	The sibling Process Hostname
Process.Parent.Path	unknown	The parent Process Path
Process.Children.Hostname	unknown	The children Process Hostname
Process.PID	unknown	Process PID
Process.Children.CbSegmentID	unknown	The children Cb 'segment' where this process instance is stored. Required to fetch further info on a process.
Process.Children.CbID	unknown	The children Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.Path	unknown	Process Path
Process.Parent.PID	unknown	The parent Process PID
Process.Children.Path	unknown	The children Process Path
Process.Name	unknown	Process Name
Process.Children.PID	unknown	The children Process PID
Process.Parent.CbID	unknown	The parent Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.CommandLine	unknown	Process CommandLine
Process.Siblings.CommandLine	unknown	The sibling Process CommandLine
Process.Siblings.Name	unknown	The sibling Process Name
Process.Parent.CommandLine	unknown	The parent Process CommandLine
Process.Parent.Hostname	unknown	The parent Process Hostname
Process.MD5	unknown	Process MD5
Process.Children.MD5	unknown	The children Process MD5
Process.Siblings.CbID	unknown	The sibling Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.Siblings.Path	unknown	The sibling Process Path
Process.Siblings.PID	unknown	The sibling Process PID
Process.StartTime	date	Start time of the process.

Command Example

Human Readable Output

cb-get-processes

---

Query processes based on given parameters

Base Command

cb-get-processes

Input

Argument Name	Description	Required
name	Filter processes by name.	Optional
group	Filter processes by group.	Optional
hostname	Filter processes by hostname.	Optional
parent-process-name	Filter processes by parent process name.	Optional
process-path	Filter processes by process path (Example: "c:\windows\resources\spoolsv.exe").	Optional
md5	Filter processes by md5 hash.	Optional
query	Query string. Accepts the same data as the search box on the Binary Search page. See https://github.com/carbonblack/cbapi/blob/master/client_apis/docs/query_overview.pdf.	Optional
rows	Return this many rows, 10 by default.	Optional
start	Start at this row, 0 by default.	Optional
sort	Sort rows by this field and order. server_added_timestamp desc by default.	Optional
facet	Return facet results. 'false' by default, set to 'true' for facets.	Optional

Context Output

Path	Type	Description
File.Name	unknown	File Name
File.MD5	unknown	File MD5
File.Path	unknown	File Path
Endpoint.Hostname	unknown	Endpoint Hostname
Process.CommandLine	unknown	Process Commandline
Process.PID	unknown	Process PID
Process.CbID	unknown	Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.CbSegmentId	unknown	Cb "segment" where this process instance is stored. Required to fetch further info on a process.
Process.Parent.PID	unknown	Process Parent PID
Process.Parent.Name	unknown	Process Parent Name
Process.StartTime	date	Start time of the process.

Command Example

Human Readable Output

cb-list-sensors

---

List the CarbonBlack sensors

Base Command

cb-list-sensors

Input

Argument Name	Description	Required
limit	The maximum amount of sensors to be returned.	Optional

Context Output

Path	Type	Description
CbResponse.Sensors.Status	unknown	Sensor Status
CbResponse.Sensors.LastUpdate	unknown	Sensor Last Updated
CbResponse.Sensors.Uptime	unknown	The Sensor uptime
CbResponse.Sensors.SupportsCbLive	unknown	Sensor Support CB Live
CbResponse.Sensors.Notes	unknown	Sensor Notes
CbResponse.Sensors.Hostname	unknown	Hostname
CbResponse.Sensors.CbSensorID	unknown	Sensor ID
CbResponse.Sensors.Isolated	unknown	Sensor Isolated
CbResponse.Sensors.IPAddresses	unknown	Sensor IP Addresses
CbResponse.Sensors.OS	unknown	Sensor OS
Endpoint.Hostname	unknown	Sensor Hostname
Endpoint.OS	unknown	Sensor OS
Endpoint.IPAddresses	unknown	Sensor IP Addresses

Command Example

Human Readable Output

cb-process-events

---

Retrieve all process events for a given process segmented by segment ID

Base Command

cb-process-events

Input

Argument Name	Description	Required
pid	the internal CB process id; this is the id field in search results.	Required
segid	the process segment id; this is the segment_id field in search results.	Required

Context Output

Path	Type	Description
Process.CrossProc.OtherProcessMD5	unknown	Other process MD5
Process.MD5	unknown	Process MD5
Process.Modules.MD5	unknown	Module MD5
Process.CommandLine	unknown	Process CommandLine
Process.Registry.RegistryPath	unknown	Registry path
Process.Path	unknown	Process Path
Process.CbID	unknown	Cb unique ID for this process instance - required (together with CbSegmentID) to fetch further info on a process.
Process.Parent.Name	unknown	The parent Process Name
Process.Hostname	unknown	Process Hostname
Process.Binaries.DigSig.Publisher	unknown	The publisher of the Digital Signature
Process.CrossProc.Action	unknown	Cross process action
Process.CrossProc.OtherProcessCbID	unknown	Other process CbID
Process.CbSegmentID	unknown	Cb 'segment' where this process instance is stored. Required to fetch further info on a process.
Process.Name	unknown	Process Name
Process.CrossProc.Time	unknown	Time of action
Process.PID	unknown	Process PID
Process.Modules.Filepath	unknown	Module path
Process.Binaries.DigSig.Result	unknown	Cb's decision after checking this binary's Digital Signature
Process.Parent.PID	unknown	The parent Process PID
Process.Binaries.MD5	unknown	Binary MD5
Process.CrossProc.OtherProcessBinary	unknown	Other process binary
Process.Registry.Time	unknown	Registry time
Process.Modules.Time	unknown	Module time

Command Example

Human Readable Output

cb-quarantine-device

---

Isolate the endpoint from the network

Base Command

cb-quarantine-device

Input

Argument Name	Description	Required
sensor	the sensor ID to quarantine.	Required

Context Output

Path	Type	Description
Endpoint.LastAction	unknown	Endpoint Actions

Command Example

Human Readable Output

cb-sensor-info

---

Display information about the given sensor

Base Command

cb-sensor-info

Input

Argument Name	Description	Required
sensor	the sensor id.	Optional
ip	returns the sensor registration(s) with specified IP address.	Optional
hostname	returns the sensor registration(s) with matching hostname.	Optional
groupid	returns the sensor registration(s) in the specified sensor group id.	Optional

Context Output

Path	Type	Description
CbResponse.Sensors.Status	unknown	Sensor Status
CbResponse.Sensors.LastUpdate	unknown	Sensor Last Updated
CbResponse.Sensors.Uptime	unknown	The Sensor uptime
CbResponse.Sensors.SupportsCbLive	unknown	Sensor Support CB Live
CbResponse.Sensors.Notes	unknown	Sensor Notes
CbResponse.Sensors.Hostname	unknown	Sensor Hostname
CbResponse.Sensors.CbSensorID	unknown	Sensor ID
CbResponse.Sensors.Isolated	unknown	Sensor Isolated
CbResponse.Sensors.IPAddresses	unknown	Sensor IP Addresses
CbResponse.Sensors.OS	unknown	Sensor OS

Command Example

Human Readable Output

cb-unblock-hash

---

Unblocking hash

Base Command

cb-unblock-hash

Input

Argument Name	Description	Required
md5hash	the hash on the block list.	Required
text	text description of block list.	Required

Context Output

Path	Type	Description
File.LastAction	unknown	Last action taken on this file

Command Example

Human Readable Output

cb-unquarantine-device

---

Unquarantine the endpoint

Base Command

cb-unquarantine-device

Input

Argument Name	Description	Required
sensor	the sensor ID to quarantine.	Required

Context Output

Path	Type	Description
Endpoint.LastAction	unknown	Endpoint Actions

Command Example

Human Readable Output

cb-version

---

Display the CarbonBlack version

Base Command

cb-version

Input

Argument Name	Description	Required

Context Output

There is no context output for this command.

Command Example

Human Readable Output

cb-watchlist-del

---

Delete a watchlist in Carbon black Response.

Base Command

cb-watchlist-del

Input

Argument Name	Description	Required
watchlist-id	Watchlist ID.	Required

Context Output

There is no context output for this command.

Command Example

Human Readable Output

cb-watchlist-get

---

Retrieve info for a watchlist in Carbon black Response.

Base Command

cb-watchlist-get

Input

Argument Name	Description	Required
watchlist-id	Watchlist ID.	Optional

Context Output

Path	Type	Description
CbResponse.Watchlists.LastHit	unknown	Watchlist last hit
CbResponse.Watchlists.TotalHits	unknown	Watchlist Total hits
CbResponse.Watchlists.SearchQuery	unknown	Cb search query used for the watchlist.
CbResponse.Watchlists.Name	unknown	Watchlist Name
CbResponse.Watchlists.Enabled	unknown	Watchlist is enabled
CbResponse.Watchlists.LastHitCount	unknown	Watchlist last hit count
CbResponse.Watchlists.DateAdded	unknown	Watchlist Date added
CbResponse.Watchlists.SearchTimestamp	unknown	Watchlist last hit count
CbResponse.Watchlists.CbWatchlistID	unknown	Watchlist ID

Command Example

Human Readable Output

cb-watchlist-new

---

Create a new watchlist in Carbon black Response.

Base Command

cb-watchlist-new

Input

Argument Name	Description	Required
search-query	the raw Carbon Black query that this watchlist matches.	Required
name	name of this watchlist.	Required

Context Output

Path	Type	Description
CbResponse.Watchlists.LastHit	unknown	Watchlist last hit
CbResponse.Watchlists.TotalHits	unknown	Watchlist Total hits
CbResponse.Watchlists.SearchQuery	unknown	Cb search query used for the watchlist.
CbResponse.Watchlists.Name	unknown	Watchlist Name
CbResponse.Watchlists.Enabled	unknown	Watchlist is enabled
CbResponse.Watchlists.LastHitCount	unknown	Watchlist last hit count
CbResponse.Watchlists.DateAdded	unknown	Watchlist Date added
CbResponse.Watchlists.SearchTimestamp	unknown	Watchlist last hit count
CbResponse.Watchlists.CbWatchlistID	unknown	Watchlist ID

Command Example

Human Readable Output

cb-watchlist-set

---

Modify a watchlist in Carbon black Response.

Base Command

cb-watchlist-set

Input

Argument Name	Description	Required
watchlist-id	Watchlist ID.	Required
search-query	the raw Carbon Black query that this watchlist matches.	Optional
name	name of this watchlist.	Optional
indexType	the type of watchlist. Valid values are 'modules' and 'events' for binary and process watchlists, respectively.	Optional

Context Output

There is no context output for this command.

Command Example

Human Readable Output

cb-alert-update

---

Alert update and resolution

Base Command

cb-alert-update

Input

Argument Name	Description	Required
uniqueId	Alert unique identifier.	Required
status	Updated alert's status: Resolved,Unresolved,In Progress or False Positive. Possible values are: Resolved, Unresolved, In Progress, False Positive.	Required
setIgnored	Whether to stop showing this type of alert. Possible values are: true, false.	Optional

Context Output

There is no context output for this command.

Command Example

Human Readable Output

cb-watchlist

---

Retrieve watchlist in Carbon black Response.

Base Command

cb-watchlist

Input

Argument Name	Description	Required

Context Output

Path	Type	Description
CbResponse.Watchlists.LastHit	unknown	Watchlist last hit
CbResponse.Watchlists.TotalHits	unknown	Watchlist Total hits
CbResponse.Watchlists.SearchQuery	unknown	Cb search query used for the watchlist.
CbResponse.Watchlists.Name	unknown	Watchlist Name
CbResponse.Watchlists.Enabled	unknown	Watchlist is enabled
CbResponse.Watchlists.LastHitCount	unknown	Watchlist last hit count
CbResponse.Watchlists.DateAdded	unknown	Watchlist Date added
CbResponse.Watchlists.SearchTimestamp	unknown	Watchlist last hit count
CbResponse.Watchlists.CbWatchlistID	unknown	Watchlist ID

Command Example

Human Readable Output

cb-binary-download

---

Retrieve a binary from CarbonBlack based on hash. Returns a .zip file containing the requested file and it's metadata.

Base Command

cb-binary-download

Input

Argument Name	Description	Required
md5	MD5 hash of the file.	Required
summary	Whether to include the summary. Possible values are: yes, no.	Optional

Context Output

Path	Type	Description
File.DigSig.Publisher	unknown	The publisher of the digital signature.
File.InternalName	unknown	The internal name.
File.ServerAddedTimestamp	unknown	The timestamp when the server was added.
File.Name	unknown	The binary name.
File.Extension	unknown	The binary extension.
File.Timestamp	unknown	The binary timestamp.
File.Hostname	unknown	The binary hostname.
File.Description	unknown	The binary description.
File.DigSig.Result	unknown	The Carbon Black decision after checking this binary's digital signature.
File.LastSeen	unknown	LThe lst time the binary was seen.
File.Path	unknown	The binary path.
File.ProductName	unknown	The product name.
File.OS	unknown	The OS.
File.MD5	unknown	The MD5 hash of the binary.
File.Company	unknown	Name of the company that released a binary.
File.DigitalSignature.Publisher	unknown	Publisher of the digital signature for the file.
File.Name	unknown	Full filename, for example data.xls.
File.Signature.OriginalName	unknown	The file's original name.
File.Signature.InternalName	unknown	The file's internal name.
File.Signature.FileVersion	unknown	The file version.
File.Signature.Description	unknown	The description of the signature.

Command Example

Human Readable Output