How to get raw process documents via Curl
search cancel

How to get raw process documents via Curl

book

Article ID: 285660

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Query for raw process document information from a standalone EDR Server

Environment

  • EDR: 6.x and higher
  • Standalone EDR Server

Resolution

See Additional Information section for clustered server environments
  1. Log into the console.
  2. Perform your search and click the process to bring you to the Process Analysis page.
  3. In the Process Analysis page grab the Unique ID (highlighted in red) from the browser URL
    https://<server>/#/analyze/00000007-0000-24c8-01d4-6cab54141c72/1540927207635?cb.legacy_5x_mode=false
  4. Log into the server via ssh/terminal and run the following command, replacing the <uniqueid>:
    curl 'http://localhost:8080/solr/reader/select?q=id:<uniqueid>*&rows=0'
    
  5. View the "numFound" and enter a value greater than in the &rows= section of the next command. 
    response":{"numFound":29,"start":0,"maxScore":1.0,"docs":
  6. Run the following command, in the example numFound came back as 29, so 40 is used to give a buffer as the rows= 
    curl 'http://localhost:8080/solr/reader/select?q=id:<uniqueid>*&wt=json&indent=true&rows=40&debug=track&sort=last_server_update%20asc' >> <uniqueid>.json && /usr/share/cb/cbpost <uniqueid>.json

Additional Information

  • Common Errors: