Skip to main content

Carbon Black Enterprise Live Response

Details
Content
Version History

Collect information and take action on remote endpoints in real time with Carbon Black Enterprise Live Response.

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	November 9, 2020
Last Release	December 28, 2020

WORKS WITH THE FOLLOWING INTEGRATIONS:

VMware Carbon Black EDR (Live Response API)

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Playbooks

Name	Description
Carbon Black Live Response - Create active session	Creates an active session.
Carbon Black Live Response - Download File	Download file from a sensor.
Carbon Black Live Response - Wait Until Command Complete	Polling command status until finished with an error or complete.
Get File Sample From Path - VMware Carbon Black EDR - Live Response API	This playbook retrieves a file from a path on an endpoint using VMware Carbon Black EDR (Live Response API). Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file.

Automations

Name	Description
CBLiveProcessList	Runs 'process list' command on a remote Carbon Black sensor

Integrations

Name	Description
VMware Carbon Black EDR (Live Response API)	Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response).