CB Response: How to Get Event Partition Status

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to get event partition status from an event node

Environment

• Carbon Black Protection Server: 6.2.0 and Above

Resolution

1. Open a session as root or su
2. Run this command

curl -k https://localhost/api/v1/storage/events/partition -H "X-Auth-Token:<Valid API Token>" | python -m json.tool

Additional Information

• Data returned will have the info for cold, warm and hot partitions on the node
• Hot partitions will not have an "endDate"