Carbon Black Response

Integration version: 27.0

Configure VMware Carbon Black EDR (EDR) to work with Google Security Operations SOAR

API Key

To obtain an API key, please complete the following steps:

  1. Log into the console
  2. Click the username in the upper right
  3. Navigate to the Profile info.

  4. Click the API Token button on the left side to reveal the API token.

    In case there is no API token displayed, click the Reset button to create a new one.

Network

Function Default Port Direction Protocol
API Multivalues Outbound apikey

Configure Carbon Black Response integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name Type Default Value Is Mandatory Description
Instance Name String N/A No Name of the Instance you intend to configure integration for.
Description String N/A No Description of the Instance.
Api Root String https://x.x.x.x Yes The address of the VMware Carbon Black EDR (EDR) instance.
Api Key String N/A Yes API key generated in the VMware Carbon Black EDR (EDR) console.
Version String 6.3 Yes The version of the product. Make sure you provide shorter form of the version. For example, instead of providing 7.4.0, provide 7.4.
Run Remotely Checkbox Unchecked No Check the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).

Actions

Binary Free Query

Description

List binaries by free query.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Query String N/A Yes Example: md5:* AND original_filename:{file-name}

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON result
[
    {
        "host_count": x,
        "digsig_result":"Signed",
        "Observed_filename": ["c:\\\\windows\\\\system32\\\\xxxxxx.exe"],
        "product_version": "10.0.17134.1",
        "digsig_issuer": "Microsoft Windows Production PCA 2011",
        "legal_copyright": "\\\\u00a9 Microsoft Corporation. All rights reserved.",
        "digsig_sign_time": "2018-04-11T19:19:00Z",
        "orig_mod_len": 20888,
        "is_executable_image": true,
        "is_64bit": true,
        "digsig_subject": "Microsoft Windows",
        "digsig_publisher": "Microsoft Corporation",
        "group": ["Default Group"],
        "file_version": "10.0.17134.1 (WinBuild.160101.0800)",
        "company_name": "Microsoft Corporation",
        "internal_name": "xxxxxxx.exe",
        "product_name": "Microsoft\\\\u00ae Windows\\\\u00ae Operating System",
        "digsig_result_code": "0",
        "timestamp": "2018-12-30T03:55:55.376Z",
        "copied_mod_len": 20888,
        "server_added_timestamp": "2018-12-30T03:55:55.376Z",
        "digsig_prog_name": "Microsoft Windows",
        "md5": "2528137C6745C4EADD87817A1909677E",
        "endpoint": ["DESKTOP-CEIFS6E|15",
                     "DESKTOP-CEIFS6E|16",
                     "LP-AVITAL|17",
                     "LAPTOP-66I4I93K|18"],
        "watchlists": [
            {
                "wid": "3",
                "value": "2018-12-30T04:00:03.635Z"
            }],
        "signed": "Signed",
        "original_filename": "xxxxxxx.exe",
        "cb_version": 520,
        "os_type": "Windows",
        "file_desc": "COM Surrogate",
        "last_seen": "2019-02-21T15:27:33.231Z"
    }
]

Block Hash

Description

Block a hash.

Parameters

N/A

Run On

This action runs on the Filehash entity.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Create Watchlist

Description

Create a watchlist for processes (type = events) or for binaries (type = modules).

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Watchlist Name String N/A Yes Name of this watchlist.
Query String N/A Yes The raw Carbon Black query that this watchlist matches.
Watchlist Type String N/A Yes The type of watchlist. e.g. modules.

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Download Binary

Description

Download a binary.

Parameters

N/A

Run On

This action runs on the Filehash entity.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIb",
        "Entity": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }
]

Enrich Binary

Description

Enrich hash with binary information from CB Response.

Parameters

N/A

Run On

This action runs on the Filehash entity.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False success:False
JSON Result
[
    {
        "EntityResult": {
            "host_count": x,
            "digsig_result": "Unsigned",
            "observed_filename":["c:\\\\\\\\TEST_source\\\\\\\\main\\\\\\\\client\\\\\\\\wpf\\\\\\\\TEST.client\\\\\\\\bin\\\\\\\\release\\\\\\\\TEST.client.exe"],
            "product_version": "x.x.x.x",
            "legal_copyright": "TEST",
            "orig_mod_len": 4108800,
            "is_executable_image": "True",
            "is_64bit": "False",
            "group": ["Default Group"],
            "file_version": "x.x.x.x",
            "comments": "Flavor=Release",
            "company_name": "TEST",
            "internal_name": "TEST.xxxxxx.exe",
            "icon": "iVBORw0KGgoAAAANSUhEUg",
            "product_name": "(unknown)",
            "digsig_result_code": "xxxxxxx",
            "timestamp": "2016-12-11T18:54:03.352Z",
            "copied_mod_len": 4108800,
            "server_added_timestamp": "2016-12-11T18:54:03.352Z",
            "md5": "82A2C91219F140BB2A4FE34A7390B6C7",
            "endpoint": ["WS-ALON|4"],
            "Watchlists": [
                {
                    "wid": "3", "value": "2016-12-11T19:00:03.232Z"
                }],
            "signed": "Unsigned",
            "original_filename": "TEST.xxxxx.exe",
            "cb_version": 520,
            "os_type": "Windows",
            "file_desc": " ",
            "last_seen": "2016-12-11T19:00:04.178Z"
        },
        "Entity": "82A2C91219F140BB2A4FE34A7123B6C7"
    }
]

Enrich Process

Description

Enrich process entity with data from CB Response.

Parameters

N/A

Run On

This action runs on the following entities:

  • Process
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": [
            {
                "modload_count": 28,
                "sensor_id": 14,
                "filtering_known_dlls": "False",
                "process_md5": "d752c96401e2540a123c599154fc6fa9",
                "parent_unique_id": "0000000e-0000-13d4-01d4-a04566d108ba-00000001",
                "emet_count": 0,
                "cmdline": "\\\\\\\\??\\\\\\\\C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\conhost.exe 0xffffffff -ForceV1",
                "last_update": "2018-12-30T13:41:43.904Z",
                "id": "x-x-x-x-x",
                "parent_name": "python.exe",
                "parent_md5": "000000000000000000000000000000",
                "group": "Default Group",
                "hostname": "TEST",
                "filemod_count": 0,
                "start": "2018-12-30T13:41:43.885Z",
                "emet_config": "",
                "netconn_count": 0,
                "interface_ip": 167772456,
                "process_pid": xxxx,
                "username": "TEST\\\\\\\\xxxxxx",
                "terminated": "True",
                "process_name": "xxxxx.exe",
                "comms_ip": xxxxxxx,
                "path": "c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\xxxxxx.exe",
                "regmod_count": 0,
                "parent_pid": 5076,
                "crossproc_count": 1,
                "current_segment": 0,
                "segment_id": 1,
                "host_type": "server",
                "processblock_count": 0,
                "os_type": "windows",
                "childproc_count": 0,
                "unique_id": "0000000e-0000-1310-01d4-a04566d29849-00000001"
            }],
        "Entity": "process.exe"
    }
]

Get FileMod Data for Process

Description

Get filemod data for a process by its ID.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Process ID String N/A Yes Process unique ID.
Segment ID String N/A Yes e.g. 1.

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
{
    "Process":
    {
        "process_md5": "517110bd83835338c037269e603db55d",
        "sensor_id": x,
        "group": "Default Group",
        "segment_id": x,
        "process_name": "xxxxxxx.exe",
        "start": "2013-09-19T22:07:07Z",
        "regmod_complete": [
            "2|2013-09-19 22:07:07.000000|\\\\\\\\registry\\\\\\\\user\\\\\\\\s-1-5-19\\\\\\\\software\\\\\\\\microsoft\\\\\\\\sqmclient\\\\\\\\reliability\\\\\\\\adaptivesqm\\\\\\\\manifestinfo\\\\\\\\version",
            "2|2013-09-19 22:09:07.000000|\\\\\\\\registry\\\\\\\\machine\\\\\\\\software\\\\\\\\microsoft\\\\\\\\reliability analysis\\\\\\\\rac\\\\\\\\wmilasttime"],
        "cmdline": "xxxxxxx.exe $(arg0)",
        "Filemod_complete": [
            "2|2013-09-19 22:07:07.000000|c:\\\\\\\\programdata\\\\\\\\microsoft\\\\\\\\rac\\\\\\\\statedata\\\\\\\\racmetadata.dat|",
            "2|2013-09-19 22:07:07.000000|c:\\\\\\\\programdata\\\\\\\\microsoft\\\\\\\\rac\\\\\\\\temp\\\\\\\\sql4475.tmp|"],
        "parent_id": "",
        "modload_complete": [
            "2013-09-19 22:07:07.000000||c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\xxxxxx.exe",
            "2013-09-19 22:07:07.000000||c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\ntdll.dll"],
        "id": "xxxxxxxxxxxxxxxx",
        "path": "c:\\\\\\\\xxxxxxx\\\\\\\\xxxxxx\\\\\\\\xxxxxxx.exe",
        "os_type": "windows",
        "last_update": "2013-09-19T22:09:07Z",
        "hostname": "xxxx-xxxxxxxxxxx"
    },
    "elapsed": 0.0126001834869
}

Get License

Description

Get the current license from CB Response.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Get Process Tree Data

Description

Get process tree data for process by the ID(JSON).

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Process ID String N/A Yes Process unique ID.
Segment ID String N/A Yes e.g. 1.

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
{
    "Process":
    {
        "process_md5": "517110bd83835338c037269e603db55d",
        "sensor_id": x,
        "group": "Default Group",
        "segment_id": x,
        "process_name": "xxxxxx.exe",
        "last_update": "2013-09-19T22:09:07Z",
        "cmdline": "taskhost.exe $(arg0)",
        "start": "2013-09-19T22:07:07Z",
        "parent_id": "xxxxxxxxx",
        "id": "xxxxxxxxx",
        "path": "c:\\\\\\\\xxxxxxx\\\\\\\\xxxxxxx\\\\\\\\xxxxxxx.exe",
        "os_type": "xxxxxxx",
        "hostname": "xxxxxxx-xxxxxx"
    },
    "Siblings": [
        {
            "process_md5": "c78655bc80301d76ed4fef1c1ea40a7d",
            "sensor_id": x,
            "group": "Default Group",
            "segment_id": x,
            "process_name": "xxxxxxxx.exe",
            "last_update": "2013-09-19T22:34:49Z",
            "start": "2013-09-10T04:10:07Z",
            "parent_id": "xxxxxxxxx",
            "id": "xxxxxxxxxxxx",
            "path": "c:\\\\\\\\xxxxxx\\\\\\\\xxxxxxx\\\\\\\\xxxxxx.exe",
            "os_type":"xxxxxx",
            "hostname": "xxx-xxxxxxx"
        }],
    "children": [],
    "parent": {
        "process_md5": "24acb7e5be595468e3b9aa488b9b4fcb",
        "sensor_id": x,
        "group": "Default Group",
        "segment_id": x,
        "process_name": "xxxxxx.exe",
        "last_update": "2013-09-19T22:09:07Z",
        "start": "2013-09-10T04:09:51Z",
        "parent_id": "xxxxxxxxxxxx",
        "id": "xxxxxxxxxxxxx",
        "path": "c:\\\\\\\\xxxxxxx\\\\\\\\xxxxxxx\\\\\\\\xxxxxx.exe",
        "os_type": "xxxxxx",
        "hostname": "xxx-xxxxxxxx"
    }
}

Get System Info

Description

Get system information for a sensor from CB Response and enrich the entity.

Parameters

N/A

Run On

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": {
            "systemvolume_total_size": "479127379968",
            "computer_name": "LP-WORKER",
            "os_environment_display_string": "Windows 10 Professional, 64-bit",
            "systemvolume_free_size": "319940304896",
            "physical_memory_size": "17058787328",
            "emet_version": "",
            "emet_dump_flags": "",
            "clock_delta": "10840",
            "supports_cblr": "True",
            "id": xx,
            "is_isolating": "False",
            "emet_process_count": 0,
            "build_id": 2,
            "uptime": "1640459",
            "computer_dns_name":"xx-xxxxxx.xxxxxx.xxxxx",
            "emet_report_setting": "(Locally configured)",
            "last_update": "2018-06-25 13:27:47.442521+03:00",
            "parity_host_id": "0",
            "power_state": 0,
            "network_isolation_enabled": "False",
            "uninstalled": "None",
            "next_checkin_time": "2018-06-25 13:28:13.089904+03:00",
            "status": "Offline",
            "num_eventlog_bytes": "13771",
            "sensor_health_message": "Elevated memory usage",
            "build_version_string": "1.1.1.1",
            "computer_sid": "S-1-5-21-x-x-x",
            "node_id": 0,
            "event_log_flush_time": "None",
            "emet_exploit_action": " (Locally configured)",
            "emet_telemetry_path":"",
            "license_expiration": "1990-01-01 00:00:00+02:00",
            "supports_isolation": "True",
            "emet_is_gpo": "False",
            "supports_2nd_gen_modloads": "False",
            "network_adapters": "x.x.x.x,xxxxxxxxx|",
            "sensor_health_status": 90,
            "registration_time": "2018-03-01 08:12:47.420579+02:00",
            "restart_queued": "False",
            "notes": "None",
            "num_storefiles_bytes": "0",
            "os_environment_id": 5,
            "cookie": 292474955,
            "shard_id": x,
            "boot_id": "xx",
            "last_checkin_time": "2018-06-25 13:27:43.091387+03:00",
            "os_type": 1,
            "group_id": x,
            "display": "True",
            "sensor_uptime": "x",
            "uninstall":"False"
        },
        "Entity": "xx-xxxxx"
    }
]

Hosts by Process

Description

Get hosts that are related to a particular process.

Parameters

N/A

Run On

This action runs on the Process entity.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": [
            {
                "systemvolume_total_size": "160534884352",
                "computer_name": "COMPUTER",
                "os_environment_display_string": "Windows 10 Server Server Standard (Evaluation), 64-bit",
                "systemvolume_free_size": "120903110656",
                "physical_memory_size": "8589463552",
                "emet_version": "",
                "emet_dump_flags": "",
                "clock_delta": "7348",
                "supports_cblr": "True",
                "id": xx,
                "is_isolating": "False",
                "emet_process_count": 0,
                "build_id": 2,
                "uptime": "5888902",
                "computer_dns_name": "COMPUTER",
                "emet_report_setting": " (Locally configured)",
                "last_update": "2019-01-07 11:07:17.187979+02:00",
                "parity_host_id": "x",
                "power_state": 0,
                "network_isolation_enabled": "False",
                "uninstalled": "None",
                "next_checkin_time": "2019-01-07 11:07:44.348203+02:00",
                "status": "Offline",
                "num_eventlog_bytes": "34800",
                "sensor_health_message": "Healthy",
                "build_version_string": "1.1.1.1",
                "computer_sid": "S-1-5-21-405201704-2854221227-856099807",
                "node_id": 0,
                "event_log_flush_time": "None",
                "emet_exploit_action": " (Locally configured)",
                "emet_telemetry_path": "",
                "license_expiration": "1990-01-01 00:00:00+02:00",
                "supports_isolation": "True",
                "emet_is_gpo": "False",
                "supports_2nd_gen_modloads": "False",
                "network_adapters": "x.x.x.x,xxxxxxxx|",
                "sensor_health_status": 100,
                "registration_time": "2018-12-22 02:46:33.629175+02:00",
                "restart_queued": "False",
                "notes": "None",
                "num_storefiles_bytes": "0",
                "os_environment_id": 8,
                "cookie": 1164577502,
                "shard_id": 0,
                "boot_id": "1",
                "last_checkin_time": "2019-01-07 11:07:14.349477+02:00",
                "os_type": 1,
                "group_id": 1,
                "display": "True",
                "sensor_uptime": "1412441",
                "uninstall": "False"
            }],
        "Entity": "xxxxxx.xxx"
    }
]

Isolate Host

Description

Isolate an endpoint from the network.

Parameters

N/A

Run On

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Kill Process

Description

Kill a process on a particular host.

Parameters

N/A

Run On

This action runs on the following entities:

  • Process
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

List Processes

Description

List processes that are related to given entities.

Parameters

N/A

Run On

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": [
            {
                "modload_count": 63,
                "sensor_id": xx,
                "filtering_known_dlls": "False",
                "process_md5": "00eb8baca58a0dd0106d67db566d6ea4",
                "parent_unique_id": "x-x-x-x-x-x",
                "emet_count": 0,
                "cmdline": "python.exe C:\\\\\\\\HOST_Server\\\\\\\\z31fmfzn.vzo.py",
                "last_update": "2018-12-30T13:39:55.642Z",
                "id": "xxxxxx-xxxx-xxxxx-xxxxxx-xxxxxxx",
                "parent_name": "xxxx.xxxxxx.xxxxxxx.xxxxxxx.exe",
                "parent_md5": "000000000000000000000000000000",
                "group": "Default Group",
                "hostname": "xxxx",
                "filemod_count": 7,
                "start": "2018-12-30T13:39:34.728Z",
                "emet_config": "",
                "netconn_count": 2,
                "interface_ip": 167772456,
                "process_pid": 6024,
                "username": "xxxx\\\\\\\\xxxx",
                "terminated": "True",
                "process_name": "xxxxx.exe",
                "comms_ip": xxxxxx,
                "path": "c:\\\\\\\\python27\\\\\\\\python.exe",
                "regmod_count": 0,
                "parent_pid": 4152,
                "crossproc_count": 1,
                "current_segment": 0,
                "segment_id": x,
                "host_type": "server",
                "processblock_count": 0,
                "os_type": "windows",
                "childproc_count": 1,
                "unique_id": "x-x-x-x-x-x"
            }],
        "Entity": "HOST"
    }
]

Ping

Description

Test Connectivity.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Process Free Query

Description

List processes by free query.

Parameters

Parameter Type Default Value Is Mandatory Description
Query String N/A Yes e.g. process_name:python.exe.

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "process_md5": "00eb8baca58a0dd0106d67db566d6ea4",
        "sensor_id": xx,
        "filtering_known_dlls": "False",
        "modload_count": 63,
        "parent_unique_id": "x-x-x-x-x-x",
        "emet_count": 0,
        "group": "Default Group",
        "cmdline": "python.exe C:\\\\\\\\bin\\\\\\\\\\\\\\\\z31fmfzn.vzo.py",
        "last_update": "2018-12-30T13:39:55.642Z",
        "id": "x-x-x-x-x",
        "parent_name": "xxxx.xxxxxx.xxxxxx.xxxxxx.exe",
        "parent_md5": "000000000000000000000000000000",
        "parent_pid": 4152,
        "hostname": "xxxx",
        "filemod_count": 7,
        "start": "2018-12-30T13:39:34.728Z",
        "emet_config": "",
        "netconn_count": 2,
        "interface_ip": xxxxxxxx,
        "process_pid": 6024,
        "username": "xxxxx\\\\\\\\xxxxx",
        "terminated": "True",
        "process_name": "xxxxxx.xxx",
        "comms_ip": xxxxxxx,
        "path": "c:\\\\\\\\python27\\\\\\\\xxxxxx.exe",
        "regmod_count": 0,
        "crossproc_count": 1,
        "current_segment": 0,
        "segment_id": x,
        "host_type": "server",
        "processblock_count": 0,
        "os_type": "windows",
        "childproc_count": 1,
        "unique_id": "x-x-x-x-x-x"
    }
]

Resolve Alert

Description

Resolve an alert.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Alert ID String N/A Yes The ID of the alert to resolve.

Run On

This action runs on all entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Unblock Hash

Description

Unblock a hash.

Parameters

N/A

Run On

This action runs on the Filehash entity.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Unisolate Host

Description

Rejoin an endpoint to the network.

Parameters

N/A

Run On

This action runs on the following entities:

  • IP Address
  • Hostname

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False

Connectors

Carbon Black Response Connector

Configure Carbon Black Response Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name Type Default Value Is Mandatory Description
Environment DDL N/A Yes

Select the required environment. For example, "Customer One".

In case that the alert's Environment field is empty, this alert will be injected to this environment.
Run Every Integer 0:0:0:10 No Select the time to run the connection.
Product Field Name String device_product Yes The field name used to determine the device product.
Event Field Name String name Yes The field name used to determine the event name (sub-type).
Script Timeout (Seconds) String 60 Yes The timeout limit (in seconds) for the python process running current script.
API Root String null Yes https://x.x.x.x
API Key Password N/A Yes N/A
Version String 6.3 Yes CB server version, default 6.3 will be used
Alerts Count Limit Integer 20 Yes Limit the number of alerts in every cycle. Example: 20
Max Days Backwards Integer 3 Yes This field is used in the connector first running cycle and determine the connector start time. Example: 3
Environment Field Name String N/A No The name of the environment's field.
List Type String N/A No Can be whitelist or blacklist.
List Operator String N/A No Can be 'exact', 'start with', 'ends with' or 'contains'.
List Fields String N/A No List of fields, comma-separated.
Proxy Server Address String N/A No The address of the proxy server to use.
Proxy Username String N/A No The proxy username to authenticate with.
Proxy Password Password N/A No The proxy password to authenticate with.

Connector Rules

Proxy Support

The connector supports Proxy.