Cb Response: How to determine top noisy and chatty hosts and processes (5.x)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To output the top list of "noisiest" hosts, processes, and parent processes that the Cb Response (version 5.x) cluster has event records for. 

Environment

• Cb Response: version 5.x

Resolution

1. Determine which shards are present on the local node: 

# cat /etc/cb/cluster.conf

2. Run commands, replacing "0" with any local shards:

Get list of "noisiest" hosts:
curl "http://127.0.0.1:8080/solr/0/terms?terms.fl=hostname&terms=true&terms.limit=50&indent=true" > "/tmp/$(hostname)_noisy_hosts.txt"

Get list of most common processes:
curl "http://127.0.0.1:8080/solr/0/terms?terms.fl=path_full&terms=true&terms.limit=50&indent=true" > "/tmp/$(hostname)_top_procs_pathfull.txt"

Get list of most common processes:
curl "http://127.0.0.1:8080/solr/0/terms?terms.fl=parent_name&terms=true&terms.limit=50&indent=true" > "/tmp/$(hostname)_top_parentprocs.txt"

3. Repeat for all nodes.

Additional Information

• Resulting files will be available in /tmp