Carbon Black Endpoint Standard

Maps incoming Carbon Black alert fields.

The category of the threat cause

The reputation of the primary involved process

The identifier of the report that contains the IOC

The source of the threat cause

The Carbon Black ES Alert Severity

The IOC field value or IOC query that cause the hit

The priority of the device assigned by the policy (LOW, MEDIUM, HIGH, MISSION_CRITICAL)

The process ID that triggered the alert

The time of the first event associated with the incident

The name of the report that contains the IOC

The time of the latest event associated with the incident

The identifier of the IOC that cause the hit

The process name that triggered the alert

The identifier of a threat which this alert belongs.

VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Deprecated. Use Carbon Black Endpoint Standard instead.

The Carbon Black Endpoint Standard Layout

Find processes using a search query (or device_id, etc.). One of the parameters is required. Returns a list of processes.

Receives event IDs and returns details about the event.

Finds events using a search query (or device_id, etc.). One of the parameters is required. It returns a list of events with general information. For detailed information about an event, use the "find event details" playbook with an event ID.

Maps incoming Carbon Black alert fields.

The IOC field value or IOC query that cause the hit

The identifier of the IOC that cause the hit

The priority of the device assigned by the policy (LOW, MEDIUM, HIGH, MISSION_CRITICAL)

The time of the latest event associated with the incident

The reputation of the primary involved process

The Carbon Black ES Alert Severity

The name of the report that contains the IOC

The identifier of the report that contains the IOC

The identifier of a threat which this alert belongs.

The source of the threat cause

Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.

Deprecated. Use Carbon Black Endpoint Standard instead.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Receives event IDs and returns details about the event.

Find processes using a search query (or device_id, etc.). One of the parameters is required. Returns a list of processes.

Finds events using a search query (or device_id, etc.). One of the parameters is required. It returns a list of events with general information. For detailed information about an event, use the "find event details" playbook with an event ID.