Deprecated. Use the cbp-fileRule-createOrUpdate command instead.
Carbon Black Enterprise Protection
- Details
- Content
- Dependencies
- Version History
Carbon Black Enterprise Protection is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform.
Automations
| Name | Description |
|---|---|
| CBPBanHash | |
| CBPFindComputer | Find a computer in CBEP/Bit9. |
| CBPCatalogFindHash | Search the CBP/Bit9 file catalog for an md5 hash. |
| CBPFindRule | Find the rule state for a hash value in CBEP/Bit9. |
| CBPApproveHash | Deprecated. Use the cbp-fileRule-createOrUpdate command instead. |
Integrations
| Name | Description |
|---|---|
| VMware Carbon Black App Control v2 | VMware Carbon Black App Control (formerly known as Carbon Black Enterprise Protection) is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform. This integration only supports Carbon Black on-premise APIs. |
Playbooks
| Name | Description |
|---|---|
| Search Endpoints By Hash - Carbon Black Protection | Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection. |
| Carbon black Protection Rapid IOC Hunting | Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9). |
Automations
| Name | Description |
|---|---|
| CBPFindRule | Find the rule state for a hash value in CBEP/Bit9. |
| CBPCatalogFindHash | Search the CBP/Bit9 file catalog for an md5 hash. |
| CBPApproveHash | Deprecated. Use the cbp-fileRule-createOrUpdate command instead. |
| CBPFindComputer | Find a computer in CBEP/Bit9. |
| CBPBanHash | Deprecated. Use the cbp-fileRule-createOrUpdate command instead. |
Integrations
| Name | Description |
|---|---|
| VMware Carbon Black App Control v2 | VMware Carbon Black App Control (formerly known as Carbon Black Enterprise Protection) is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform. This integration only supports Carbon Black on-premise APIs. |
Playbooks
| Name | Description |
|---|---|
| Search Endpoints By Hash - Carbon Black Protection | Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection. |
| Carbon black Protection Rapid IOC Hunting | Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9). |
Required Content Packs (2)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (4)
| Pack Name | Pack By |
|---|---|
| Common Scripts | By: Cortex XSOAR |
| Aggregated Scripts | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
1.0.45 - 4096037 (July 8, 2025)
1.0.44 - R3980324 (June 26, 2025)
- 38987
Download
Integrations
VMware Carbon Black App Control v2
- Metadata and documentation improvements.
Scripts
CBPFindRule
- Metadata and documentation improvements.
CBPFindComputer
- Metadata and documentation improvements.
CBPCatalogFindHash
- Metadata and documentation improvements.
- 38987
Download
1.0.45 - 4096037 (July 8, 2025)
1.0.44 - R3980324 (June 26, 2025)
- 38987
Download
Integrations
VMware Carbon Black App Control v2
- Metadata and documentation improvements.
Scripts
CBPFindRule
- Metadata and documentation improvements.
CBPFindComputer
- Metadata and documentation improvements.
CBPCatalogFindHash
- Metadata and documentation improvements.
- 38987
Download
PUBLISHER
PLATFORMS
Cortex XSOARCortex XSIAM
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | December 29, 2020 | |
| Last Release | March 23, 2026 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
