Carbon Black Endpoint Standard

Maps incoming Carbon Black alert fields.

The IOC field value or IOC query that cause the hit

The reputation of the primary involved process

The process name that triggered the alert

The time of the latest event associated with the incident

The identifier of the report that contains the IOC

The category of the threat cause

The process ID that triggered the alert

The name of the report that contains the IOC

The Carbon Black ES Alert Severity

The identifier of the IOC that cause the hit

The priority of the device assigned by the policy (LOW, MEDIUM, HIGH, MISSION_CRITICAL)

The identifier of a threat which this alert belongs.

The source of the threat cause

The time of the first event associated with the incident

Deprecated. Use Carbon Black Endpoint Standard instead.

VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

The Carbon Black Endpoint Standard Layout

Finds events using a search query (or device_id, etc.). One of the parameters is required. It returns a list of events with general information. For detailed information about an event, use the "find event details" playbook with an event ID.

Find processes using a search query (or device_id, etc.). One of the parameters is required. Returns a list of processes.

Receives event IDs and returns details about the event.

Maps incoming Carbon Black alert fields.

The time of the latest event associated with the incident

The identifier of the report that contains the IOC

The identifier of the IOC that cause the hit

The identifier of a threat which this alert belongs.

The source of the threat cause

The IOC field value or IOC query that cause the hit

The name of the report that contains the IOC

The Carbon Black ES Alert Severity

The reputation of the primary involved process

The priority of the device assigned by the policy (LOW, MEDIUM, HIGH, MISSION_CRITICAL)

Endpoint Standard (formerly called Carbon Black Defense), a Next-Generation Anti-Virus + EDR. Collect Anti-Virus & EDR alerts and Audit Log Events.

Deprecated. Use Carbon Black Endpoint Standard instead.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

VMware Carbon Black Endpoint Standard Live Response is a feature that enables security operators to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, and execute and terminate processes.

Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set.

Receives event IDs and returns details about the event.

Find processes using a search query (or device_id, etc.). One of the parameters is required. Returns a list of processes.

Finds events using a search query (or device_id, etc.). One of the parameters is required. It returns a list of events with general information. For detailed information about an event, use the "find event details" playbook with an event ID.