Functionality

Functionality

The purpose of this section is to outline or document the implemented functionality.

Functionality that's dependent on or only works with a certain type of Carbon Black product will only show up in the cbinterface command line if that respective product is configured.

Functionality that works independent of configured product:

• Process Querying
• Process Investigation
• Live Response
  • Commands
  • Collection
  • Remediation
  • Playbooks
  • Scripted Live Response
  • Quarantine/Isolation/Containment
  • General/Other
    • Put files
    • Execute commands
  • Enumerations
  • Sessions

Functionality specific to Carbon Black PSC:

• Device Queries
  • Intel
    • Watchlists
    • Feeds
    • Alerts
    • Migrations
  • Universal Binary Store

Functionality specific to Carbon Black Response:

• Sensor Queries
• Watchlists