How to get raw process documents via Curl
book
Article ID: 285660
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Query for raw process document information from a standalone EDR Server
Environment
- EDR: 6.x and higher
- Standalone EDR Server
Resolution
See Additional Information section for clustered server environments
- Log into the console.
- Perform your search and click the process to bring you to the Process Analysis page.
- In the Process Analysis page grab the Unique ID (highlighted in red) from the browser URL
https://<server>/#/analyze/00000007-0000-24c8-01d4-6cab54141c72/1540927207635?cb.legacy_5x_mode=false
- Log into the server via ssh/terminal and run the following command, replacing the <uniqueid>:
curl 'http://localhost:8080/solr/reader/select?q=id:<uniqueid>*&rows=0'
- View the "numFound" and enter a value greater than in the &rows= section of the next command.
response":{"numFound":29,"start":0,"maxScore":1.0,"docs":
- Run the following command, in the example numFound came back as 29, so 40 is used to give a buffer as the rows=
curl 'http://localhost:8080/solr/reader/select?q=id:<uniqueid>*&wt=json&indent=true&rows=40&debug=track&sort=last_server_update%20asc' >> <uniqueid>.json && /usr/share/cb/cbpost <uniqueid>.json
Feedback
thumb_up
Yes
thumb_down
No