Cyware Orchestrate

The Vmware CarbonBlack Cloud Enterprise EDR app in the Orchestrate application allows security teams to integrate with Carbon Black ThreatHunter as Carbon Black Cloud Enterprise EDR, to gain unfiltered visibility for top Security Operations Centers (SOCs) and Incident Response (IR) teams. Carbon Black ThreatHunter is delivered through the Carbon Black Cloud, a next-generation endpoint protection platform that consolidates security in the cloud using a single agent, console and dataset.

The VMware CarbonBlack Cloud Enterprise EDR app in the Orchestrate application can perform the below listed actions:

All the actions configured in the VMware CarbonBlack Cloud Enterprise EDR app relate to private APIs. VMware CarbonBlack Cloud Enterprise EDR Enterprise subscription is required to access the private APIs.

The following configuration parameters are required for the VMware CarbonBlack Cloud Enterprise EDR app to communicate with VMware CarbonBlack Cloud Enterprise EDR enterprise application. The parameters can be configured by creating instances in the app.

This action can be used to get details of a watchlist.

Input Parameters

Example Request

[
    {
        "watchlist_id": "jEi9DvRgRRC2D3CPXtuOlg"
    }
]

This action can be used to get details of a feed.

Input Parameters

Example Request

[
    {
        "feed_id": "TtEd0qO0R2uEipWr8gYNTw"
    }
]

This action can be used to get details of a report from a feed.

Input Parameters

Example Request

[
    {
        "feed_id": "TtEd0qO0R2uEipWr8gYNTw",
        "report_id": "tc-104232995"
    }
]

This action can be used to get information about a feed.

Input Parameters

Example Request

[
    {
        "feed_id": "TtEd0qO0R2uEipWr8gYNTw"
    }
]

This action can be used to get a list of feed reports.

Input Parameters

Example Request

[
    {
        "feed_id": "TtEd0qO0R2uEipWr8gYNTw"
    }
]

This action can be used to get a list of all feeds.

Input Parameters

Example Request

[
   {
     “public_feeds”: “False“
   }
]

This action can be used to get a list of all Watchlists.

Input Parameters

No input parameters are required for this action.

This action can be used to search feeds.

Input Parameters

Example Request

[
    {
        "extra_params": {},
        "search_query": "url"
    }
]