CB Response: How to download events for a process within a specific time period

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to download events for a process within a specific time period from the browser.

Environment

• CB Response Server: 6.x

Resolution

1. Navigate to the CB Response Analyze page Navigate for the specific process you wish to export events for, your URL should appear similar to the following example: 

Example URL: https://<your_server>/#/analyze/00000050-0000-025c-01d4-daaf3d153e7f/1556532324995?cb.legacy_5x_mode=false 

      Note: In the above example, 00000050-0000-025c-01d4-daaf3d153e7f is the guid of the process, and 1556532324995 is the segment ID (which we will not be using).

2. Modify the URL.  Replace <your_server>, <guid> <to_timestamp>, and <from_timestamp> with your values in the format:

https://<your_server>/api/v5/process/<guid>/0/event?cb.min_last_update=<from_timestamp>&cb.max_last_update=<to_timestamp>&cb.event_count=1000&cb.event_start=0

3. Navigate to the URL to generate an export of events within the specified timeframe.

Additional Information

• Output format is in JSON only.  CSV is not supported.