CB Response: How to Use Regex Wildcard on Ingress Filters

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to use Regex wildcard on Ingress Filters

Environment

• Carbon Black Response API: All Versions

Resolution

• Regular Expression: rx|
• Case Insensitive Regular Expression: rxi|.
• In this example we will filter out Google Chrome processes based on the path_filters parameter, ignoring the install drives and case insensitive

  curl -XPOST -H "X-AUTH-Token: <API TOKEN HERE> -H "Content-Type: application/json" "https://localhost/api/v1/ingress_whitelist" -k -d '
  [
   {
     "id": "ChromeExample",
     "global": true,
     "path_filters":[rxi|.*\\\\Program Files\\(x86\\)\\\\Google\\\\Chrome\\\\Application\\\\.*]
   }
  ]'

Additional Information

• Path backslashes need to be converted to four backslashes "\\\\Application"
• Wildcards need to be preceded with a dot asterisks "\\\\.*"
• Paths containing parentheses need to be cancelled out with two backslashes "\\(x86\\)"