VMware Carbon Black Cloud Enterprise EDR CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

VMWare CB Enterprise EDR Reports

Sample Response:

{
    "took": 1,
    "timed_out": false,
    "hits": {
        "total": 1,
        "max_score": null,
        "hits": [
            {
                "_index": "report_index-2018.11.17-1",
                "_type": "_doc",
                "_id": "0FbiTt9eQKWQqjh0viwqA",
                "_score": null,
                "_source": {
                    "severity": 8,
                    "access": "private",
                    "iocs": [
                        {
                            "field": "process_hash",
                            "values": [
                                "7c3d70d49af6e4c7b4aad3623fdcf65b"
                            ],
                            "link": null,
                            "match_type": "equality",
                            "id": "c6ee778750efb8f5493975197548cfc6"
                        }
                    ],
                    "link": "https://ui.threatstream.com/detail/7c3d70d49af6e4c7b4aad3623fdcf65b",
                    "description": "7c3d70d49af6e4c7b4aad3623fdcf65b was first seen on 2020-01-30T13:37:38, and last updated on 2020-01-30T13:37:38",
                    "title": "itype=mal_md5, source=iDefense test campaign - Richard",
                    "tags": [
                        "FD-4304 - CrowdStrike IoC - iMcD",
                        "apt_domain"
                    ],
                    "source_label": "Custom",
                    "id": "0FbiTt9eQKWQqjh0viwqA",
                    "timestamp": 1580391458,
                   "feed": {
                        "feed_category": "Partner",
                        "feed_summary": "Sample threatstream feed to group reports by id",
                        "feed_id": "0FbiTt9eQKWQqjh0viwqA",
                        "feed_name": "ThreatStream_ID",
                        "feed_provider_url": "https://ui.threatstream.com"
                    },
                    "telemetry": {
                        "global_hit_rate_1d": 0,
                        "global_hit_rate_1w": 0
                    }
                },
                "sort": [
                    "0FbiTt9eQKWQqjh0viwqA"
                ]
            }
        ]
    }
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides