EDR: Collecting a User API Token From the Server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Users may need the API token for a generic account used for integrations. If using a service like OKTA, accessing the account from the UI may not be possible.

Environment

• EDR: All Supported Versions

Resolution

The token can be acquired via a query to the underlying Postgres database. Substitute username with the account whose token needs to be collected.

psql cb -p 5002 -c "select auth_token from cb_user where username='username'"

Additional Information

If console access is available then the API Token can be found here