Cyware Orchestrate

The VMware Carbon Black Cloud Endpoint Standard Live Response app in the Orchestrate application allows security teams to integrate with VMware Carbon Black Cloud Endpoint Standard Live Response enterprise application to collect information and take action on remote endpoints in real time. These actions include the ability to upload, download, and remove files, retrieve and remove registry entries, dump contents of physical memory, execute and terminate processes.

The VMware Carbon Black Cloud Endpoint Standard Live Response app in the Orchestrate application can perform the below listed actions:

All the actions configured in the VMware Carbon Black Cloud Endpoint Standard Live Response app relate to private APIs. VMware Carbon Black Cloud Endpoint Standard Live Response Enterprise subscription is required to access the private APIs.

The following configuration parameters are required for the VMware Carbon Black Cloud Endpoint Standard Live Response app to communicate with VMware Carbon Black Cloud Endpoint Standard Live Response enterprise application. The parameters can be configured by creating instances in the app.

This action can be used to start a session for a Device.

Input Parameters

Example Request

[
    {
        "device_id": "3419258"
    }
]

This action can be used to reset the timed out session for a device.

Input Parameters

Example Request

[
    {
        "session_id": "1105:3419258"
    }
]

This action can be used to issue a command to a Device.

Input Parameters

Example Request

[
    {
        "retry": true,
        "session_id": "1105:3419258",
        "command_name": "get file",
        "extra_params": 
        {
             “Object”: “C:\Users\Administrator\Downloads\sample_file.txt”
        }
    }
]

This action can be used to get the status of a Session from a Device.

Input Parameters

Example Request

[
    {
        "session_id": "1105:3419258"
    }
]

This action can be used to get the status of a command issued to a Device.

Input Parameters

Example Request

[
    {
        "command_id": 1,
        "session_id": "1105:3419258"
    }
]

This action can be used to get Metadata of a file.

Input Parameters

Example Request

[
    {
        "file_id": "075a85b0-c24d-4bb2-a065-205d3af74ffa",
        "session_id": "1105:3419258"
    }
]

This action can be used to get file content.

Input Parameters

Example Request

[
    {
        "file_id": "075a85b0-c24d-4bb2-a065-205d3af74ffa",
        "filename": "sample.txt",
        "session_id": "1105:3419258"
    }
]

This action can be used to close the Session in a Device.

Input Parameters

Example Request

[
    {
        "session_id": "1105:3419258"
    }
]

This action can be used to cancel a command issued to a device.

Input Parameters

Example Request

[
    {
        "session_id": "1105:3419258",
        “command_id”: “1”
    }
]