Using The Carbon Black Cloud V6 Devices API

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

The Carbon Black Cloud Devices API has been updated from V3 to V6 and has two important changes:

• An API URL change
  • V3 URL: https://api-<psc-hostname>/integrationServices/v3/device
  • V6 URL: https://defense-<psc-hostname>/appservices/v6/orgs/{org_key}/devices/_search/download?status=all
• V6 API Requires custom RBAC settings

Environment

• Carbon Black Cloud: All Versions

Resolution

Always check https://developer.carbonblack.com/reference/carbon-black-cloud/ for the latest API changes!

When using the new V6 Device API URL:

1. For the <psc-hostname> use the Dashboard URL associated with your Org ex.  https://defense-prod05.conferdeploy.net/
2. Use your org_key found on the API Keys page 

Here is an example URL: https://defense-prod05.conferdeploy.net/appservices/v6/orgs/NOT12345/devices/_search/download?status=all

Create a custom access level and new API key:

1. Select Settings from the left side nav of the console
2. Select API Keys
3. Select the Access Levels tab (to the right of API Keys)
4. Click Add Access Level
5. Fill in the Name and Description fields
6. From the .Notation Name column drop down to Device, select the Read check box and click save
7. Go back to the API Keys tab and select Add API Key
8. Enter a Name, select Custom from the Access level, select the Name of the Custom Access Level you just created
9. Record your new API Secret Key / API ID
10. Test your configuration with Postman, Curl or other tool

The configuration of the access level and API key should look like this:

Additional Information

• Currently the V3 URL is still working however it is considered to be deprecated, please move to the new V6 Device API
• Full Curl Example 

  curl -H X-Auth-Token:API Secret Key / API ID \ https://defense-<psc-hostname>/appservices/v6/orgs/[org_key]/devices/_search/download?status=all