DOCSEARCHbyAlgolia
Submit Docs

Carbon Black Developer Documentation

website·Indexed 40 days ago

https://developer.carbonblack.com/

API references and integration guides for Carbon Black products, including Carbon Black EDR (formerly CB Response), Carbon Black Cloud Enterprise EDR (formerly CB ThreatHunter), and Carbon Black Cloud Endpoint Standard (formerly CB Defense). Documentation covers REST APIs for process data, Live Response, Watchlists, Feed Management, Sandbox behavioral analysis, and the Event Message Bus, as well as Python CbAPI and connectors for Splunk, TAXII, and AWS S3.

Tokens
725K
Snippets
2.9K
Records
5.2K
Agent score
67%

What's inside Carbon Black

  2. Overview of VMware Carbon Black Cloud Alerts v7 API

    The Alerts v7 API improves alert management, consumption, and triage within the Carbon Black Cloud. Key enhancements include improved filtering (by creation time, category, type, and status), the inclusion of the process_cmdline field to reduce the need for enrichment calls, and the ability to close alerts based on search criteria with a determination (e.g., true positive or false positive). Additionally, notes can now be added at both the alert and threat levels with a maximum length of 20,000 characters. Grouped and Ungrouped Alert Searches are now handled by separate APIs.

  3. Overview of VMware Carbon Black Cloud dashboards

    v200

    The app includes several dashboards with specific data requirements:

    • CBC Alerts Overview: Overview of all CBC alerts. Requires Alerts data source (Data Forwarder or built-in Alerts Input).
    • CBC Endpoint Event Overview: Overview of endpoint events. Requires Endpoint Events data source via Data Forwarder.
    • CBC Alert Details: Detailed alert info. Clicking an Alert ID triggers an Alert Action to fetch Observations. Includes 'Link to Alert' for the CBC console and 'Alert History' for timeline views.
    • CBC Devices Overview: Overview of active devices. Requires Endpoint Events data source via Data Forwarder.
    • CBC Processes Overview: Overview of processes. Requires Endpoint Events data source via Data Forwarder.
    • CBC Vulnerabilities Overview: Vulnerability info. Requires built-in Vulnerabilities Input.
    • Application Health Overview: Found under Administration; monitors API errors, failures, and severity levels.

  5. Overview of Carbon Black Cloud Platform APIs

    Platform APIs provide access to core Carbon Black Cloud capabilities common across multiple modules, such as searching for Alerts, Devices, and Processes, and managing policy settings. These APIs are available to all Carbon Black Cloud customers and are augmented by product-specific APIs. Note that the data returned by an API varies based on the modules deployed in the environment (e.g., the Alerts API returns Watchlist Alerts for Enterprise EDR customers and CB Analytics Alerts for Endpoint Standard customers).

  6. Overview of Carbon Black Cloud Host-Based Firewall

    The Host-Based Firewall is a functional component of Carbon Black Cloud that provides security analysts with visibility into endpoint network traffic and the ability to control allowed traffic. It integrates firewall management directly into the endpoint and workload protection platform, allowing SOCs to manage network activity for devices both inside and outside the corporate network from a single platform.

  7. Overview of VMware Carbon Black Cloud Splunk Dashboards

    v200

    The app includes several dashboards with specific data requirements:

    • CBC Alerts Overview: Overview of all CBC alerts. Requires Alerts data source (Data Forwarder or built-in Alerts Input).
    • CBC Endpoint Event Overview: Overview of endpoint events. Requires Endpoint Events data source via Data Forwarder.
    • CBC Alert Details: Detailed alert info. Clicking an Alert ID triggers an Alert Action to fetch Observations. Includes 'Link to Alert' (external link to CBC console), 'Observations' tab, and 'Alert History' tab.
    • CBC Devices Overview: Overview of active devices. Requires Endpoint Events data source via Data Forwarder.
    • CBC Processes Overview: Overview of processes. Requires Endpoint Events data source via Data Forwarder.
    • CBC Vulnerabilities Overview: Overview of vulnerability info. Requires built-in Vulnerabilities Input.
    • Application Health Overview: Found under the Administration menu; monitors alerts, events, and API errors (total_failures, messages, severity).

  8. Overview of Carbon Black Cloud Workload for Public Cloud

    VMware Carbon Black Cloud Workload for Public Cloud is designed to secure AWS workloads and simplify AWS account management. Key capabilities include managing single or multiple AWS accounts, providing auto-generated CI-CD agent installation packages, and offering enhanced visibility into protected and unprotected workload inventories.

  9. Overview of Live Response API

    The Live Response API allows security operators to perform real-time actions on remote endpoints, such as uploading/downloading files, managing registry entries, dumping physical memory, and executing or terminating processes.

    Key architectural details:

    • Authentication: Uses the standard EDR REST API X-Auth-Token header.
    • Asynchronous Execution: Command APIs return immediately with a command ID. Users must poll the API using that ID until a result status is returned.
    • Session-Based: All commands require an active session with a sensor. Sessions are kept alive for a specific timeout period before being recycled.

  10. Overview of Differential Analysis API

    The Differential Analysis API is part of the Audit and Remediation solution. It enables users to compare two Live Query runs to determine what changed on endpoints and when. Common use cases include monitoring for unexpected installations, changes to browser extensions, security setting modifications (e.g., drive encryption, password standards), and monitoring files or registry keys with low change probability.

  11. Overview of the Carbon Black SDK

    The Carbon Black SDK (cb-integration) is a cross-platform framework used to create connectors and integrations for Carbon Black products. It provides a lightweight Linux container that includes Python bindings for the Carbon Black API (CBAPI) and the cb-integration libraries. The SDK uses Supervisor to manage connectors, handling auto-restarts, log rotation, and monitoring, replacing the need for standalone RPMs.
    # Pull the base SDK container
docker pull cbdevnetwork/cbsdk

  12. Overview of Carbon Black Cloud Watchlist Information Model

    The Watchlist system is organized into three hierarchical units of information:

    1. IOCs (Indicators of Compromise): The smallest unit; single indicators searched across Enterprise EDR data.
    2. Reports: Collections of one or more IOCs. Reports allow for enabling or disabling groups of IOCs for hits and alerts in a single action.
    3. Watchlists: Collections of one or more Reports. Watchlists allow for enabling or disabling alerting and reporting for all contained Reports in a single action.

    Constraints:

    • Maximum 1,000 IOCs per report.
    • Maximum 10,000 reports per feed or watchlist. Exceeding these limits prevents editing or searching IOCs and Reports.