Search For Command Line Parameters In A Process

Products

• Carbon Black EDR

Issue/Introduction

Process for searching for command line parameters in a process

Environment

• Carbon Black EDR Server: Supported Versions

Resolution

1. Utilize the API document. In the process analysis page, the browser URL will look like the following:

   https://<servername>/#/analyze/000000eb-0000-0d64-01d4-6c999e4e589f/1540496044494?cb.legacy_5x_mode=false

2. Change the /#/analyze/ to /api/v1/process. Example: 

   https://<servername>/api/v1/process/000000eb-0000-0d64-01d4-6c999e4e589f/1540496044494?cb.legacy_5x_mode=false

3. This will list out the process document. The cmdline and the tokenized format will be seen, that can then, be used for searching. 

Additional Information

Tokenizing the cmdline is difficult due to limitations with Solr and the many cmd variations with special characters.