Carbon Black Cloud (CBC)-Platform APIs 🗝-Access Profiles and Grants API

Create Grant for a Principal Get Permitted Roles Update Grant of a Principal Update Profile of Principal’s Grant Bulk Fetch Grants Delete Profile Get Grant of a Principal Create Profile in Principal’s Grant Delete Grant for a Principal

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Search Alerts - Ungrouped

Export Alerts Get alert histogram Get Alert History Find alerts - Ungrouped Get Alert Details Validate Search Request Facet alerts - ungrouped Get Alert Search Suggestions

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Search Alerts - Grouped by Threat Id

Facet Alerts - Grouped Get alert histogram for grouped alerts Find Alerts - Grouped

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Notes on Alerts

Get Notes Create a Note Delete a Note

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-tags

Get a list of tags based on Threat Id Delete a Tag Update Tags

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Threats

Delete a threat-level note Get notes for a threat Get History of a Threat ID Create a threat-level note

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Workflow

Bulk Update Alerts Workflow by Search Definition

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Deprecated - v6

Update Bulk Event Workflows Get Alert by ID Create Workflow Facet Alerts Create Note Alert Search Get Alert Search Suggestions Delete Note Get Notes Get Status of Workflow Update

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Groups

Update Asset Group Create Asset Group Preview Asset Groups Change Get Asset Group by ID Export Asset Groups Get All Asset Groups Get Asset Group Stats Delete Asset Group Search for Asset Groups

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Members

Remove Members from Asset Group Get Asset Group Members Find Which Member Belongs to Which Group

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Group Query

Get Asset Group Configuration Validate Query Supported Attribute Keywords

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups

Preview Policies Rank Change

Carbon Black Cloud (CBC)-Platform APIs 🗝-Audit Log API

Search Audit Logs Fetch from Audit Log Queue Export Audit Logs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Data Forwarder Configuration API-Deprecated

⚠️ Create Forwarder ⚠️ Forwarder Healthcheck ⚠️ Delete Forwarder ⚠️ Get Configured Forwarders ⚠️ Edit Forwarder

Carbon Black Cloud (CBC)-Platform APIs 🗝-Data Forwarder Configuration API

Delete Filter on Forwarder Validate Filter Edit Filter on Forwarder Create Filter on Forwarder Forwarder Healthcheck Edit Forwarder Get Configured Forwarders Create Forwarder Delete Forwarder Get Available Data Versions Get Specific Forwarder Filterable Event Schema Get Specific Filter on Forwarder Get Filters on Forwarder

Carbon Black Cloud (CBC)-Platform APIs 🗝-Devices API

Specific Device Information Legacy Export Devices (CSV)Export Devices Search Devices Scroll Devices Device Facet Device Actions

Carbon Black Cloud (CBC)-Platform APIs 🗝-Job Service API

Get Job Details Get Job Progress Start an Export Events Job Download Job Output

Carbon Black Cloud (CBC)-Platform APIs 🗝-Live Response APIs

Get All Sessions Retrieve Command Get Commands List Get File Metadata Close Session Delete File Issue Command Retrieve Command Copy Get All Files Metadata Start Session Disable Live Response Upload File to Carbon Black Cloud Get File Content

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Policy Management

Get Policy Details Delete Policy Get Policy Summary Create Policy Update Policy

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Policy Rules Management

Add Policy Rule Delete Policy Rule Update Policy Rule Bulk Modify Policy Rules

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Configs

Presentation Lookup Parameter Schema

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Core Prevention

Delete Specific Core Prevention Rule Config Update Core Prevention Rule Configs Get Core Prevention Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Data Collection

Get Data Collection Rule Configs Delete Specific Data Collection Rule Config Delete Data Collection Rule Configs Update Data Collection Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Host-Based Firewall

Export Host-Based Firewall Rules Get Host-Based Firewall Rule Configs Delete Specific Host-Based Firewall Rule Config Update Host-Based Firewall Rule Configs Copy Host-Based Firewall Rule Config Delete Host-Based Firewall Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Bypass

Delete User Parameters for All Bypass Rule Configs.Update Bypass Rule Configs List Bypass Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls for Processes

Get Time Limits for Available Data (v1)Start a Details Request for Processes (v2)Retrieve Results for a Process Facets Search (v2)Process Search Validation (v2)Start a Facet Search on Processes (v2)Retrieve Results for a Process Summary or Tree Search (v2)Process Search Suggestions (v2)Cancel a Process Search (v1)Start a Process Search (v2)Start a Process Summary Search (v2)Retrieve Results for a Process Detail Search (v2)Retrieve Results for a Process Search (v2)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls for Events

Get Events Facet Associated with a Process (v2)Get Validation for Event Search (v1)Get Suggestions for Event Searching (v1)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls using Enterprise EDR Watchlist Features

Evaluate Processes for a Watchlist (v1)Get Report Hits (v1)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Deprecated

⚠️ Get the Status of a Process Search (v1)⚠️ Get the Status of a Process Detail Search (v2)Process Search Validation (v1)Process Search Suggestions (v1)⚠️ Get the Status of Process Summary Search (v2)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API

Export Process Events Search Results with Jobs Service

Carbon Black Cloud (CBC)-Platform APIs 🗝-Reputation Override API 🗝

Search Reputation Overrides Delete Reputation Override Export Reputation Overrides Configure Reputation Override Bulk Delete Reputation Overrides Get Reputation Override

Carbon Black Cloud (CBC)-Platform APIs 🗝-Script Deobfuscation API

De-obfuscate script

Carbon Black Cloud (CBC)-Platform APIs 🗝-Sensor Update Services API-Deprecated

Get a list of all the Sensors in the given Job Get the details of a job Cancel an in progress Job Create a Sensor Update Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-Sensor Update Services API

Get Sensor Update Job Create Sensor Update Job Search Sensor Update Jobs Update Sensor Update Job Name Search Sensors in Sensor Update Job Export Sensors in Sensor Update Job Stop Sensor Update Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-User Management API

Create User Reset Google Authenticator Registration Delete User Modify User List All Users

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Organization Level

Get Asset View with Vulnerability Summary Get Vulnerability List for Specific OS and Application Get Asset View with Vulnerability Summary for vCenter Get a Vulnerability List in CSV Format Get a Vulnerability List for a vCenter Server in CSV Format Get Vulnerability Summary for vCenter Export Asset View with Vulnerability Summary Get Vulnerability List for Specific OS and Application in vCenter Get Vulnerability Summary Export Asset View with Vulnerability Summary for vCenter

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Device Level

Perform Action on a Device Get a Vulnerability List for Specific vCenter Device in CSV Format Get Specific vCenter Device Vulnerability List Get a Vulnerability List for Specific Device in CSV Format Get Specific Device Vulnerability List Get Specific Device Vulnerability Summary Perform Action on a vCenter Device Get Specific vCenter Device Vulnerability Summary

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Vulnerability Level

Dismiss Edit Vulnerabilities Get Affected Assets for Specific Vulnerability in vCenter Get Vulnerability Details Get Affected Assets for Specific Vulnerability

Carbon Black Cloud (CBC)-Platform APIs 🗝-Network Threat Metadata Service API

Get metadata for a detector (rule)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observations Search Job

Get Results Create Search Job Get Grouped Results

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observation Detail Job

Get Results Create Detail Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observation Facet Job

Start Facet Job Get Facet Results

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API

Search Suggestions for Observations Export Observations Search Results with Jobs Service Validate Observation Search

Carbon Black Cloud (CBC)-Audit and Remediation API-Differential Analysis API

Get Facets From Live Query Results Copy

Carbon Black Cloud (CBC)-Audit and Remediation API-LiveQuery REST API 🗝-Live Query Run

Get Device Summary From Results Get Query Run Results Get Facets From Live Query Results Get Live Query Recommendations Delete Query Run Get Device Summary Facets Get Query History Get Query Details Stop Query Run Scroll All Run Results Start Query Run

Carbon Black Cloud (CBC)-Audit and Remediation API-LiveQuery REST API 🗝-Live Query Template

Delete Query Schedule by ID Search Live Query Templates Retrieve Live Query Template by ID Create Live Query Template Edit Live Query Template by ID

Carbon Black Cloud (CBC)-Containers 🗝-Management-Policies

Create or Update Policy Get All Policies Delete Policy Get Policy

Carbon Black Cloud (CBC)-Containers 🗝-Management-Scopes

Get Scope With Policy Create or Update Scope Get All Scopes With Policies Get All Scopes Get Specified Scope Delete Scope

Carbon Black Cloud (CBC)-Containers 🗝-Management-Rules

Get All Rules Delete Custom Rule

Carbon Black Cloud (CBC)-Containers 🗝-Management-Templates

Create or Update a Template Add Rules to Templates Delete Custom Template Get All Templates

Carbon Black Cloud (CBC)-Containers 🗝-Image Scanning - Account Analysis Overview

Get clusters, namespaces and repositories New Vulnerabilities - previous 24 hours Search Vulnerabilities Over Time Fixes Available Scan Status

Carbon Black Cloud (CBC)-Containers 🗝-Scan Logs

Get Scan Log Facets Search Scan Logs Get Metadata of Scan Logs

Carbon Black Cloud (CBC)-Containers 🗝-Image Analysis Inventory

Search Images Get Image Facets Search Repositories

Carbon Black Cloud (CBC)-Containers 🗝-Image Scanning Vulnerabilities

Search Vulnerabilites for CVE information Get Vulnerability Summary Search Workloads for Vulnerabilities Search Vulnerabilities Exceptions Get CVE

Carbon Black Cloud (CBC)-Containers 🗝-Setup API

Get Operator Compatibility Check Status of a Custom Resource Create Custom Resource Get Full Operator Compatibility Get Operator Installation Data Get Sensor Metadata Get CLI Installation Command Get Download Links for CLI

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Audit Log and Notifications

Get Notifications 🗝Audit Log Events

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Approvals

Delete Approval by ID Search Approvals Bulk Create Approvals Update Approval Get Approval by ID Export USB Approvals Export

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Blocks

Get Blocks Get Block by ID Delete Block by ID Update Block Bulk Create Blocks

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-USB Devices

Get USB Device by ID Search USB Devices Export USB Devices Inventory Get Endpoints associated with a USB device Facet USB Devices

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Products

Get USB Device Vendors and Products Seen

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Enriched Events Search API

Retrieve Results for an Enriched Events Facet Search (v2)Retrieve Results for an Enriched Event Aggregation Search (v1)Export Enriched Events Search Results with Jobs Service Start an Enriched Events Search (v2)Retrieve Results for an Enriched Events Search (v2)Start Aggregation Search on Enriched Events (v1)Request Details for Enriched Events (v2)Retrieve Results for an Enriched Event Detail Search (v2)Start a Facet Search on Enriched Events (v2)

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Recommendation API

Search Recommendations Recommendation Workflow

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Deprecated-⚠️ Live Response APIs 🗝

⚠️ Get Status of Session ⚠️ Start a new session ⚠️ Send Command to Endpoint ⚠️ Close a session ⚠️ Get File Metadata ⚠️ Get File Content ⚠️ Get Status of Command

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Deprecated

⚠️ Get details for a Specific Event ⚠️ Add Rule to Existing Policy ⚠️ Get Details on Alert ⚠️ Get List of Policies Get the Enriched Events Detail Search Status (v2)⚠️ Find Processes ⚠️ Update Existing Rule ⚠️ Create New Policy Get the Enriched Events Search Status (v1)⚠️ Delete Policy ⚠️ Update Existing Policy ⚠️ Change Status of an Individual Device ⚠️ Bulk Sensor Data Retrieval ⚠️ Remove Rule from Existing Policy ⚠️ Find Events ⚠️ Get Status of Individual Device ⚠️ Retrieve Policy by ID ⚠️ Device Status

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Feed Search API

Health Check Feed Search Feed Field Suggest

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Feed Manager API

Create a New Private Feed ⚠️ Create a New Public Feed Get Specific Feed Update Reserved Feed Delegates Get Reports Update Report Delete report Replace Reports Update Feed Info Get all Feeds Delete Feed Convert Legacy Query Get Reserved Feed Delegates Get Report Create a New Reserved Feed Get Feed Info

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-⚠️ Process Search v1

⚠️ Evaluate Processes for a Watchlist ⚠️ Process Summary ⚠️ Get Time Limits for Available Data ⚠️ Process Tree ⚠️ Get Suggestions for Event Searching ⚠️ Process Search Validation ⚠️ Get Events Associated with a Given Process ⚠️ Get a List of All Available Process Result Sets ⚠️ Get Validation for Event Search ⚠️ Get Report Hits ⚠️ Process Search Suggestions ⚠️ Get Search Process Results ⚠️ Get the Status of a Query ⚠️ Cancel Process Search ⚠️ Start an Asynchronous Process Search ⚠️ Health Check

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-⚠️ Process Search v2

⚠️ Get Events Facet Associated with a Given Process ⚠️ Get Process Search Results ⚠️ Get Enriched Events Facet Results ⚠️ Start a Process Facet Job ⚠️ Get Events Associated with a Given Process ⚠️ Get Enriched Events Search Results ⚠️ Start a Process Search Job ⚠️ Get Process Facets ⚠️ Start Enriched Events Facet Job ⚠️ Start an Enriched Events Search Job

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Unified Binary Store

Download File File Path Input Device Summary Request Signature Retrieve Metadata

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Watchlist

Delete Watchlist Get Watchlist Tag Status Get Report Ignore Status Re-activate IOC Enable Watchlist Tags Get Report Healthcheck Disable Watchlist Alerts Ignore IOC Disable Watchlist Tags Get Watchlist Alert Status Get Watchlist Bulk Ignore Report and IOCs Search (Get) Watchlist Telemetry Get Ignore Status for Provided Report IDs Re-activate Report Update Watchlist ⚠️ Get Watchlist Telemetry Set Custom Report Severity Get All Watchlists Create New Report Enable Watchlist Alerts Get Custom Severity for Report Get IOC Ignore Status Update a Report Remove Report Remove Custom Report Severity Get Custom Report Severities Create New Watchlist Ignore Report

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Search

Get Auth Events Search Suggestions Get Auth Events Search Group Results Get Auth Events Search Validation Start Auth Events Search Job Get Auth Events Search Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Details

Start Auth Events Detail Job Get Auth Events Detail Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Facet

Start Auth Events Facet Job Get Auth Events Detail Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events

Export Auth Events Search Results with Jobs Service Get Auth Events Descriptions

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Threat Hunt

Get Threat Hunt Information

Carbon Black Cloud (CBC)-Workload 🗝-Appliance Service API

Update Appliance Info Register Appliance Post Worker Heartbeat Time Interval Get Appliance Health details

Carbon Black Cloud (CBC)-Workload 🗝-Sensor Lifecycle Management

Get Sensor Configuration Template Get Sensor Kit and Configuration Links Request Workload Sensor Installation

Carbon Black Cloud (CBC)-Workload 🗝-VM Workloads Search API-Deprecated - v1

Fetch Compute Resource by ID Search and Facet Compute Resources

Carbon Black Cloud (CBC)-Workload 🗝-VM Workloads Search API

Search AWS Compute Resources Download AWS Compute Resources Facet AWS Compute Resources Check Compute Resource Eligibility Get Compute Resource by ID Get AWS Compute Resource Summary

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Settings

Update Organization Settings for Compliance Assessment Get Organization Settings for Compliance Assessment

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Benchmark Configuration

Clone a Benchmark Set Get Specified Rule Search Rules in a Benchmark Set Execute Action on a Benchmark Set - Enable, Disable, Reassess Update Benchmark Set Execute Action on Specified Devices in a Benchmark Set.Get All Benchmark Set Sections Update Benchmark Set Rules Search Benchmark Sets Delete Benchmark Set

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Compliance Information

Search Compliance Information for Devices Export Compliance Information for Devices Search Device Rule Results Search Rule Compliance Summaries Search Compliance Results for a Device Search Compliance Summaries for a Benchmark Set Export Rule Compliance Summaries

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Devices

Export Devices in a Benchmark Set Search Devices in a Benchmark Set

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Bundles

Get Compliance Bundle Version Updates Get Rule Info for Bundle Version Acknowledge Compliance Bundle Version Diff Compliance Bundle Versions

Carbon Black Cloud (CBC)-Workload 🗝-Public Cloud Account API

Get Cloud Account by Id Import Cloud Accounts by CSV Get External ID for AWS Account Perform Action on Multiple Accounts Facet Cloud Accounts Download Cloud Account Import Template Onboard Multiple Accounts Create Provision Template Validate Account Roles Delete Provision Template Get Regions for a Cloud Account Update Cloud Account Delete SSM Document Bulk Delete Cloud Account Delete Cloud Account Add SSM Document Export Cloud Accounts Onboard New Cloud Account Get Details of a Cloud Provider Search Cloud Accounts

On Prem-CB EDR-Process Data

Process Event Details Process Preview Process Summary Process Search Collective Defense Cloud Query Process Segment Details

On Prem-CB EDR-Binary Data

Binary Search Retrieve Binary Metadata Download Binary Retrieve Binary Icon

On Prem-CB EDR-Alerts

Bulk Update Alerts Update/Resolve Alerts Search Alerts

On Prem-CB EDR-Administrative APIs

CB Enterprise Protection Integration Server License Server License CB Enterprise Protection Integration

On Prem-CB EDR-Banning

Ban Binary by Hash Ban Binary by Hash

On Prem-CB EDR-Watchlists & Feeds

Delete Feed by ID Update Feed by ID Update Watchlist by ID Get Watchlist by ID Get Watchlists Delete Watchlist by ID Create Watchlist Create Feed Get Feeds Get Feed by ID

On Prem-CB EDR-Threat Reports

Search Threat Reports Bulk Modify Threat Reports

On Prem-CB EDR-Sensors/Endpoints

Retrieve/Modify Sensor Details

On Prem-CB EDR-Live Response

Close Sessions Issue Commands View Current Sessions Start a New Session

On Prem-App Control

Carbon Black Cloud (CBC)-Platform APIs 🗝-Access Profiles and Grants API

Create Grant for a Principal Get Permitted Roles Update Grant of a Principal Update Profile of Principal’s Grant Bulk Fetch Grants Delete Profile Get Grant of a Principal Create Profile in Principal’s Grant Delete Grant for a Principal

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Search Alerts - Ungrouped

Export Alerts Get alert histogram Get Alert History Find alerts - Ungrouped Get Alert Details Validate Search Request Facet alerts - ungrouped Get Alert Search Suggestions

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Search Alerts - Grouped by Threat Id

Facet Alerts - Grouped Get alert histogram for grouped alerts Find Alerts - Grouped

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Notes on Alerts

Get Notes Create a Note Delete a Note

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-tags

Get a list of tags based on Threat Id Delete a Tag Update Tags

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Threats

Delete a threat-level note Get notes for a threat Get History of a Threat ID Create a threat-level note

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Workflow

Bulk Update Alerts Workflow by Search Definition

Carbon Black Cloud (CBC)-Platform APIs 🗝-Alerts API-Deprecated - v6

Update Bulk Event Workflows Get Alert by ID Create Workflow Facet Alerts Create Note Alert Search Get Alert Search Suggestions Delete Note Get Notes Get Status of Workflow Update

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Groups

Update Asset Group Create Asset Group Preview Asset Groups Change Get Asset Group by ID Export Asset Groups Get All Asset Groups Get Asset Group Stats Delete Asset Group Search for Asset Groups

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Members

Remove Members from Asset Group Get Asset Group Members Find Which Member Belongs to Which Group

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups-Group Query

Get Asset Group Configuration Validate Query Supported Attribute Keywords

Carbon Black Cloud (CBC)-Platform APIs 🗝-Asset Groups

Preview Policies Rank Change

Carbon Black Cloud (CBC)-Platform APIs 🗝-Audit Log API

Search Audit Logs Fetch from Audit Log Queue Export Audit Logs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Data Forwarder Configuration API-Deprecated

⚠️ Create Forwarder ⚠️ Forwarder Healthcheck ⚠️ Delete Forwarder ⚠️ Get Configured Forwarders ⚠️ Edit Forwarder

Carbon Black Cloud (CBC)-Platform APIs 🗝-Data Forwarder Configuration API

Delete Filter on Forwarder Validate Filter Edit Filter on Forwarder Create Filter on Forwarder Forwarder Healthcheck Edit Forwarder Get Configured Forwarders Create Forwarder Delete Forwarder Get Available Data Versions Get Specific Forwarder Filterable Event Schema Get Specific Filter on Forwarder Get Filters on Forwarder

Carbon Black Cloud (CBC)-Platform APIs 🗝-Devices API

Specific Device Information Legacy Export Devices (CSV)Export Devices Search Devices Scroll Devices Device Facet Device Actions

Carbon Black Cloud (CBC)-Platform APIs 🗝-Job Service API

Get Job Details Get Job Progress Start an Export Events Job Download Job Output

Carbon Black Cloud (CBC)-Platform APIs 🗝-Live Response APIs

Get All Sessions Retrieve Command Get Commands List Get File Metadata Close Session Delete File Issue Command Retrieve Command Copy Get All Files Metadata Start Session Disable Live Response Upload File to Carbon Black Cloud Get File Content

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Policy Management

Get Policy Details Delete Policy Get Policy Summary Create Policy Update Policy

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Policy Rules Management

Add Policy Rule Delete Policy Rule Update Policy Rule Bulk Modify Policy Rules

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Configs

Presentation Lookup Parameter Schema

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Core Prevention

Delete Specific Core Prevention Rule Config Update Core Prevention Rule Configs Get Core Prevention Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Data Collection

Get Data Collection Rule Configs Delete Specific Data Collection Rule Config Delete Data Collection Rule Configs Update Data Collection Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Host-Based Firewall

Export Host-Based Firewall Rules Get Host-Based Firewall Rule Configs Delete Specific Host-Based Firewall Rule Config Update Host-Based Firewall Rule Configs Copy Host-Based Firewall Rule Config Delete Host-Based Firewall Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Policy Service API-Rule Config - Bypass

Delete User Parameters for All Bypass Rule Configs.Update Bypass Rule Configs List Bypass Rule Configs

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls for Processes

Get Time Limits for Available Data (v1)Start a Details Request for Processes (v2)Retrieve Results for a Process Facets Search (v2)Process Search Validation (v2)Start a Facet Search on Processes (v2)Retrieve Results for a Process Summary or Tree Search (v2)Process Search Suggestions (v2)Cancel a Process Search (v1)Start a Process Search (v2)Start a Process Summary Search (v2)Retrieve Results for a Process Detail Search (v2)Retrieve Results for a Process Search (v2)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls for Events

Get Events Facet Associated with a Process (v2)Get Validation for Event Search (v1)Get Suggestions for Event Searching (v1)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Calls using Enterprise EDR Watchlist Features

Evaluate Processes for a Watchlist (v1)Get Report Hits (v1)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API-Deprecated

⚠️ Get the Status of a Process Search (v1)⚠️ Get the Status of a Process Detail Search (v2)Process Search Validation (v1)Process Search Suggestions (v1)⚠️ Get the Status of Process Summary Search (v2)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Process Search API

Export Process Events Search Results with Jobs Service

Carbon Black Cloud (CBC)-Platform APIs 🗝-Reputation Override API 🗝

Search Reputation Overrides Delete Reputation Override Export Reputation Overrides Configure Reputation Override Bulk Delete Reputation Overrides Get Reputation Override

Carbon Black Cloud (CBC)-Platform APIs 🗝-Script Deobfuscation API

De-obfuscate script

Carbon Black Cloud (CBC)-Platform APIs 🗝-Sensor Update Services API-Deprecated

Get a list of all the Sensors in the given Job Get the details of a job Cancel an in progress Job Create a Sensor Update Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-Sensor Update Services API

Get Sensor Update Job Create Sensor Update Job Search Sensor Update Jobs Update Sensor Update Job Name Search Sensors in Sensor Update Job Export Sensors in Sensor Update Job Stop Sensor Update Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-User Management API

Create User Reset Google Authenticator Registration Delete User Modify User List All Users

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Organization Level

Get Asset View with Vulnerability Summary Get Vulnerability List for Specific OS and Application Get Asset View with Vulnerability Summary for vCenter Get a Vulnerability List in CSV Format Get a Vulnerability List for a vCenter Server in CSV Format Get Vulnerability Summary for vCenter Export Asset View with Vulnerability Summary Get Vulnerability List for Specific OS and Application in vCenter Get Vulnerability Summary Export Asset View with Vulnerability Summary for vCenter

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Device Level

Perform Action on a Device Get a Vulnerability List for Specific vCenter Device in CSV Format Get Specific vCenter Device Vulnerability List Get a Vulnerability List for Specific Device in CSV Format Get Specific Device Vulnerability List Get Specific Device Vulnerability Summary Perform Action on a vCenter Device Get Specific vCenter Device Vulnerability Summary

Carbon Black Cloud (CBC)-Platform APIs 🗝-Vulnerability Assessment API-Vulnerability Level

Dismiss Edit Vulnerabilities Get Affected Assets for Specific Vulnerability in vCenter Get Vulnerability Details Get Affected Assets for Specific Vulnerability

Carbon Black Cloud (CBC)-Platform APIs 🗝-Network Threat Metadata Service API

Get metadata for a detector (rule)

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observations Search Job

Get Results Create Search Job Get Grouped Results

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observation Detail Job

Get Results Create Detail Job

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API-Observation Facet Job

Start Facet Job Get Facet Results

Carbon Black Cloud (CBC)-Platform APIs 🗝-Observations API

Search Suggestions for Observations Export Observations Search Results with Jobs Service Validate Observation Search

Carbon Black Cloud (CBC)-Audit and Remediation API-Differential Analysis API

Get Facets From Live Query Results Copy

Carbon Black Cloud (CBC)-Audit and Remediation API-LiveQuery REST API 🗝-Live Query Run

Get Device Summary From Results Get Query Run Results Get Facets From Live Query Results Get Live Query Recommendations Delete Query Run Get Device Summary Facets Get Query History Get Query Details Stop Query Run Scroll All Run Results Start Query Run

Carbon Black Cloud (CBC)-Audit and Remediation API-LiveQuery REST API 🗝-Live Query Template

Delete Query Schedule by ID Search Live Query Templates Retrieve Live Query Template by ID Create Live Query Template Edit Live Query Template by ID

Carbon Black Cloud (CBC)-Containers 🗝-Management-Policies

Create or Update Policy Get All Policies Delete Policy Get Policy

Carbon Black Cloud (CBC)-Containers 🗝-Management-Scopes

Get Scope With Policy Create or Update Scope Get All Scopes With Policies Get All Scopes Get Specified Scope Delete Scope

Carbon Black Cloud (CBC)-Containers 🗝-Management-Rules

Get All Rules Delete Custom Rule

Carbon Black Cloud (CBC)-Containers 🗝-Management-Templates

Create or Update a Template Add Rules to Templates Delete Custom Template Get All Templates

Carbon Black Cloud (CBC)-Containers 🗝-Image Scanning - Account Analysis Overview

Get clusters, namespaces and repositories New Vulnerabilities - previous 24 hours Search Vulnerabilities Over Time Fixes Available Scan Status

Carbon Black Cloud (CBC)-Containers 🗝-Scan Logs

Get Scan Log Facets Search Scan Logs Get Metadata of Scan Logs

Carbon Black Cloud (CBC)-Containers 🗝-Image Analysis Inventory

Search Images Get Image Facets Search Repositories

Carbon Black Cloud (CBC)-Containers 🗝-Image Scanning Vulnerabilities

Search Vulnerabilites for CVE information Get Vulnerability Summary Search Workloads for Vulnerabilities Search Vulnerabilities Exceptions Get CVE

Carbon Black Cloud (CBC)-Containers 🗝-Setup API

Get Operator Compatibility Check Status of a Custom Resource Create Custom Resource Get Full Operator Compatibility Get Operator Installation Data Get Sensor Metadata Get CLI Installation Command Get Download Links for CLI

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Audit Log and Notifications

Get Notifications 🗝Audit Log Events

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Approvals

Delete Approval by ID Search Approvals Bulk Create Approvals Update Approval Get Approval by ID Export USB Approvals Export

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Blocks

Get Blocks Get Block by ID Delete Block by ID Update Block Bulk Create Blocks

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-USB Devices

Get USB Device by ID Search USB Devices Export USB Devices Inventory Get Endpoints associated with a USB device Facet USB Devices

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Device Control API 🗝-Products

Get USB Device Vendors and Products Seen

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Enriched Events Search API

Retrieve Results for an Enriched Events Facet Search (v2)Retrieve Results for an Enriched Event Aggregation Search (v1)Export Enriched Events Search Results with Jobs Service Start an Enriched Events Search (v2)Retrieve Results for an Enriched Events Search (v2)Start Aggregation Search on Enriched Events (v1)Request Details for Enriched Events (v2)Retrieve Results for an Enriched Event Detail Search (v2)Start a Facet Search on Enriched Events (v2)

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Recommendation API

Search Recommendations Recommendation Workflow

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Deprecated-⚠️ Live Response APIs 🗝

⚠️ Get Status of Session ⚠️ Start a new session ⚠️ Send Command to Endpoint ⚠️ Close a session ⚠️ Get File Metadata ⚠️ Get File Content ⚠️ Get Status of Command

Carbon Black Cloud (CBC)-Endpoint Standard API (NGAV)-Deprecated

⚠️ Get details for a Specific Event ⚠️ Add Rule to Existing Policy ⚠️ Get Details on Alert ⚠️ Get List of Policies Get the Enriched Events Detail Search Status (v2)⚠️ Find Processes ⚠️ Update Existing Rule ⚠️ Create New Policy Get the Enriched Events Search Status (v1)⚠️ Delete Policy ⚠️ Update Existing Policy ⚠️ Change Status of an Individual Device ⚠️ Bulk Sensor Data Retrieval ⚠️ Remove Rule from Existing Policy ⚠️ Find Events ⚠️ Get Status of Individual Device ⚠️ Retrieve Policy by ID ⚠️ Device Status

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Feed Search API

Health Check Feed Search Feed Field Suggest

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Feed Manager API

Create a New Private Feed ⚠️ Create a New Public Feed Get Specific Feed Update Reserved Feed Delegates Get Reports Update Report Delete report Replace Reports Update Feed Info Get all Feeds Delete Feed Convert Legacy Query Get Reserved Feed Delegates Get Report Create a New Reserved Feed Get Feed Info

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-⚠️ Process Search v1

⚠️ Evaluate Processes for a Watchlist ⚠️ Process Summary ⚠️ Get Time Limits for Available Data ⚠️ Process Tree ⚠️ Get Suggestions for Event Searching ⚠️ Process Search Validation ⚠️ Get Events Associated with a Given Process ⚠️ Get a List of All Available Process Result Sets ⚠️ Get Validation for Event Search ⚠️ Get Report Hits ⚠️ Process Search Suggestions ⚠️ Get Search Process Results ⚠️ Get the Status of a Query ⚠️ Cancel Process Search ⚠️ Start an Asynchronous Process Search ⚠️ Health Check

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-⚠️ Process Search v2

⚠️ Get Events Facet Associated with a Given Process ⚠️ Get Process Search Results ⚠️ Get Enriched Events Facet Results ⚠️ Start a Process Facet Job ⚠️ Get Events Associated with a Given Process ⚠️ Get Enriched Events Search Results ⚠️ Start a Process Search Job ⚠️ Get Process Facets ⚠️ Start Enriched Events Facet Job ⚠️ Start an Enriched Events Search Job

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Unified Binary Store

Download File File Path Input Device Summary Request Signature Retrieve Metadata

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Watchlist

Delete Watchlist Get Watchlist Tag Status Get Report Ignore Status Re-activate IOC Enable Watchlist Tags Get Report Healthcheck Disable Watchlist Alerts Ignore IOC Disable Watchlist Tags Get Watchlist Alert Status Get Watchlist Bulk Ignore Report and IOCs Search (Get) Watchlist Telemetry Get Ignore Status for Provided Report IDs Re-activate Report Update Watchlist ⚠️ Get Watchlist Telemetry Set Custom Report Severity Get All Watchlists Create New Report Enable Watchlist Alerts Get Custom Severity for Report Get IOC Ignore Status Update a Report Remove Report Remove Custom Report Severity Get Custom Report Severities Create New Watchlist Ignore Report

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Search

Get Auth Events Search Suggestions Get Auth Events Search Group Results Get Auth Events Search Validation Start Auth Events Search Job Get Auth Events Search Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Details

Start Auth Events Detail Job Get Auth Events Detail Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events-Events Facet

Start Auth Events Facet Job Get Auth Events Detail Job Results

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Auth Events

Export Auth Events Search Results with Jobs Service Get Auth Events Descriptions

Carbon Black Cloud (CBC)-Enterprise EDR API (EDR) 🗝-Threat Hunt

Get Threat Hunt Information

Carbon Black Cloud (CBC)-Workload 🗝-Appliance Service API

Update Appliance Info Register Appliance Post Worker Heartbeat Time Interval Get Appliance Health details

Carbon Black Cloud (CBC)-Workload 🗝-Sensor Lifecycle Management

Get Sensor Configuration Template Get Sensor Kit and Configuration Links Request Workload Sensor Installation

Carbon Black Cloud (CBC)-Workload 🗝-VM Workloads Search API-Deprecated - v1

Fetch Compute Resource by ID Search and Facet Compute Resources

Carbon Black Cloud (CBC)-Workload 🗝-VM Workloads Search API

Search AWS Compute Resources Download AWS Compute Resources Facet AWS Compute Resources Check Compute Resource Eligibility Get Compute Resource by ID Get AWS Compute Resource Summary

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Settings

Update Organization Settings for Compliance Assessment Get Organization Settings for Compliance Assessment

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Benchmark Configuration

Clone a Benchmark Set Get Specified Rule Search Rules in a Benchmark Set Execute Action on a Benchmark Set - Enable, Disable, Reassess Update Benchmark Set Execute Action on Specified Devices in a Benchmark Set.Get All Benchmark Set Sections Update Benchmark Set Rules Search Benchmark Sets Delete Benchmark Set

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Compliance Information

Search Compliance Information for Devices Export Compliance Information for Devices Search Device Rule Results Search Rule Compliance Summaries Search Compliance Results for a Device Search Compliance Summaries for a Benchmark Set Export Rule Compliance Summaries

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Devices

Export Devices in a Benchmark Set Search Devices in a Benchmark Set

Carbon Black Cloud (CBC)-Workload 🗝-CIS Benchmarks API-Bundles

Get Compliance Bundle Version Updates Get Rule Info for Bundle Version Acknowledge Compliance Bundle Version Diff Compliance Bundle Versions

Carbon Black Cloud (CBC)-Workload 🗝-Public Cloud Account API

Get Cloud Account by Id Import Cloud Accounts by CSV Get External ID for AWS Account Perform Action on Multiple Accounts Facet Cloud Accounts Download Cloud Account Import Template Onboard Multiple Accounts Create Provision Template Validate Account Roles Delete Provision Template Get Regions for a Cloud Account Update Cloud Account Delete SSM Document Bulk Delete Cloud Account Delete Cloud Account Add SSM Document Export Cloud Accounts Onboard New Cloud Account Get Details of a Cloud Provider Search Cloud Accounts

On Prem-CB EDR-Process Data

Process Event Details Process Preview Process Summary Process Search Collective Defense Cloud Query Process Segment Details

On Prem-CB EDR-Binary Data

Binary Search Retrieve Binary Metadata Download Binary Retrieve Binary Icon

On Prem-CB EDR-Alerts

Bulk Update Alerts Update/Resolve Alerts Search Alerts

On Prem-CB EDR-Administrative APIs

CB Enterprise Protection Integration Server License Server License CB Enterprise Protection Integration

On Prem-CB EDR-Banning

Ban Binary by Hash Ban Binary by Hash

On Prem-CB EDR-Watchlists & Feeds

Delete Feed by ID Update Feed by ID Update Watchlist by ID Get Watchlist by ID Get Watchlists Delete Watchlist by ID Create Watchlist Create Feed Get Feeds Get Feed by ID

On Prem-CB EDR-Threat Reports

Search Threat Reports Bulk Modify Threat Reports

On Prem-CB EDR-Sensors/Endpoints

Retrieve/Modify Sensor Details

On Prem-CB EDR-Live Response

Close Sessions Issue Commands View Current Sessions Start a New Session

On Prem-App Control

Home Carbon Black Carbon Black Cloud (CBC)-Containers 🗝-Management-TemplatesDelete Custom Template

Delete Custom Template

DELETE {{HOST}}/{{ACCOUNT}}/guardrails/management/templates/{{CUSTOM_TEMPLATE_ID}}

HEADERS

Key	Datatype	Required	Description
`X-AUTH-TOKEN`	string

Add Rules to Templates

Get All Templates