Skip to main content

Block Endpoint - Carbon Black Response V2.1

This Playbook is part of the Carbon Black Enterprise Response Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

Carbon Black Response - isolates an endpoint for a given hostname.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.




  • IsIntegrationAvailable
  • Set


  • cb-edr-sensors-list
  • cb-edr-quarantine-device

Playbook Inputs#

NameDescriptionDefault ValueRequired
HostnameThe hostname to isolate.WIN1Optional
Sensor_idThe sensor ID of the endpoint.Optional

Playbook Outputs#

CarbonBlackEDR.SensorThe sensor info.unknown
CarbonBlackEDR.Sensor.systemvolume_total_sizeThe size, in bytes, of the system volume of the endpoint on which the sensor is installed.
CarbonBlackEDR.Sensor.emet_telemetry_pathThe path of the EMET telemetry associated with the sensor.unknown
CarbonBlackEDR.Sensor.os_environment_display_stringHuman-readable string of the installed OS.unknown
CarbonBlackEDR.Sensor.emet_versionThe EMET version associated with the sensor.unknown
CarbonBlackEDR.Sensor.emet_dump_flagsThe flags of the EMET dump associated with the sensor.unknown
CarbonBlackEDR.Sensor.clock_deltaThe clock delta associated with the sensor.unknown
CarbonBlackEDR.Sensor.supports_cblrWhether the sensor supports Carbon Black Live Response (CbLR).unknown
CarbonBlackEDR.Sensor.sensor_uptimeThe uptime of the process.unknown
CarbonBlackEDR.Sensor.last_updateWhen the sensor was last updated.unknown
CarbonBlackEDR.Sensor.physical_memory_sizeThe size in bytes of physical memory.unknown
CarbonBlackEDR.Sensor.build_idThe sensor version installed on this endpoint. From the /api/builds/ endpoint.unknown
CarbonBlackEDR.Sensor.uptimeEndpoint uptime in seconds.unknown
CarbonBlackEDR.Sensor.is_isolatingBoolean representing sensor-reported isolation status.unknown
CarbonBlackEDR.Sensor.event_log_flush_timeIf event_log_flush_time is set, the server will instruct the sensor to immediately
send all data before this date, ignoring all other throttling mechanisms.
To force a host current, set this value to a value far in the future.
When the sensor has finished sending its queued data, this value will be null.
CarbonBlackEDR.Sensor.computer_dns_nameThe DNS name of the endpoint on which the sensor is installed.unknown
CarbonBlackEDR.Sensor.emet_report_settingThe report setting of the EMET associated with the sensor.unknown
CarbonBlackEDR.Sensor.idThe ID of this sensor.unknown
CarbonBlackEDR.Sensor.emet_process_countThe number of EMET processes associated with the sensor.unknown
CarbonBlackEDR.Sensor.emet_is_gpoWhether the EMET is a GPO.unknown
CarbonBlackEDR.Sensor.power_stateThe sensor power state.unknown
CarbonBlackEDR.Sensor.network_isolation_enabledBoolean representing the network isolation request status.unknown
CarbonBlackEDR.Sensor.systemvolume_free_sizeThe amount of free bytes on the system volume.unknown
CarbonBlackEDR.Sensor.statusThe sensor status.unknown
CarbonBlackEDR.Sensor.num_eventlog_bytesThe number of event log bytes.unknown
CarbonBlackEDR.Sensor.sensor_health_messageHuman-readable string indicating the sensor’s self-reported status.unknown
CarbonBlackEDR.Sensor.build_version_stringHuman-readable string of the sensor version.unknown
CarbonBlackEDR.Sensor.computer_sidMachine SID of this host.unknown
CarbonBlackEDR.Sensor.next_checkin_timeNext expected communication from this computer in server-local time and zone.unknown
CarbonBlackEDR.Sensor.node_idThe node ID associated with the sensor.unknown
CarbonBlackEDR.Sensor.cookieThe cookie associated with the sensor.unknown
CarbonBlackEDR.Sensor.emet_exploit_actionThe EMET exploit action associated with the sensor.unknown
CarbonBlackEDR.Sensor.computer_nameNetBIOS name of this computer.unknown
CarbonBlackEDR.Sensor.license_expirationWhen the license of the sensor expires.unknown
CarbonBlackEDR.Sensor.supports_isolationWhether the sensor supports isolation.unknown
CarbonBlackEDR.Sensor.parity_host_idThe ID of the parity host associated with the sensor.unknown
CarbonBlackEDR.Sensor.supports_2nd_gen_modloadsWhether the sensor support modload of 2nd generation.unknown
CarbonBlackEDR.Sensor.network_adaptersA pipe-delimited list of IP,MAC pairs for each network interface.unknown
CarbonBlackEDR.Sensor.sensor_health_statusSelf-reported health score, from 0 to 100. Higher numbers indicate a better health status.unknown
CarbonBlackEDR.Sensor.registration_timeTime this sensor was originally registered in server-local time and zone.unknown
CarbonBlackEDR.Sensor.restart_queuedWhether a restart of the sensor is queued.unknown
CarbonBlackEDR.Sensor.notesThe notes associated with the sensor.unknown
CarbonBlackEDR.Sensor.num_storefiles_bytesNumber of storefiles bytes associated with the sensor.unknown
CarbonBlackEDR.Sensor.os_environment_idThe ID of the OS environment of the sensor.unknown
CarbonBlackEDR.Sensor.shard_idThe ID of the shard associated with the sensor.unknown
CarbonBlackEDR.Sensor.boot_idA sequential counter of boots since the sensor was installed.unknown
CarbonBlackEDR.Sensor.last_checkin_timeLast communication with this computer in server-local time and zone.unknown
CarbonBlackEDR.Sensor.os_typeThe operating system type of the computer.unknown
CarbonBlackEDR.Sensor.group_idThe sensor group ID this sensor is assigned to.unknown
CarbonBlackEDR.Sensor.uninstallWhen set, indicates the sensor will be directed to uninstall on the next check-in.unknown

Playbook Image#

Block Endpoint - Carbon Black Response V2.1