Carbon Black Protection Bit9

This app supports various investigative and containment actions on Carbon Black Enterprise Protection (formerly Bit9)Built by Splunk LLC

Default Version 2.0.10

September 17, 2021

Compatibility

SOAR On-Prem, SOAR Cloud

Platform Version: 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9

Rating

(0)

Support

Splunk Supported

Ranking

#3 in Endpoint

This app supports various investigative and containment actions on Carbon Black Enterprise Protection (formerly Bit9)

Supported actions

test connectivity: Validate the API Token by attempting to connect to the Device URL. This action runs a quick query on the device to check the connection and token
hunt file: Searches for a particular file across all the endpoints
upload file: Upload a file to a computer
analyze file: Analyze a file on a computer
unblock hash: Unblocks a particular hash
block hash: Ban the file hash
get system info: Get information about an endpoint