Find binary and process counts for an endpoint

Products

• Carbon Black EDR

Issue/Introduction

Find the binary and process counts related to a given endpoint running the EDR sensor

Environment

• Carbon Black EDR Server: All Versions
• Carbon Black API

Resolution

Details can be collected either directly from the Primary server or using the REST API

• To query the Primary server directly via the browser:
  • Endpoint for related processes:

    https://<server>/api/v1/process?cb.urlver=1&q=sensor_id%3A<SENSOR_ID>&rows=0&start=0&facet=false

  • Endpoint for related binaries:

    https://<server>/api/v1/binary?cb.urlver=1&cb.q.sensor_id=<SENSOR_ID>&sort=server_added_timestamp%20desc&rows=0&start=0&facet=false

Additional Information

• Replace <server> and <SENSOR_ID> with the appropriate information accordingly 
• Using REST API will require API Token.