EDR: How to Use Postman For API

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Basic setup on how to use postman for EDR API

Environment

• EDR Server: All Versions
• API

Resolution

• Setup
  • Under the Headers Tab add a key for "X-Auth-Token" and fill in the Value with a user API Token
  • Add a key of "Content-Type" and value "application/json"
• GET
  • For this example we will pull the Top 10 Newest, Unresolved Alerts in the triage alerts page

    https://<myserver>/api/v2/alert?cb.urlver=1&cb.fq.status=Unresolved&sort=created_time%20desc&rows=10&start=0

  • Click Send
• POST
  • For this example we will resolve a specific alert using the alert id (unique_id) returned from the first query

    https://<myserver>/api/v1/alerts

  • Select the Body tab > Raw > and highlight JSON in the drop-down
  • Enter the JSON request into the body

    {
    	"alert_ids": ["1b52d759-938d-462b-abe3-b884fd3e190e", "ad82e63d-f466-43f3-bcca-a3b05bb6bb11"],
    	"requested_status": "resolved"
    }

  • Hit send to resolve the alerts
     

Additional Information

• More information about the supported API calls https://developer.carbonblack.com/reference/enterprise-response/6.3/rest-api/
• Another example of using Postman from the developer network https://developer.carbonblack.com/guide/enterprise-response/cbrestapiquickstart/