EDR: How to get sensor versions using REST API

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Pull a list of sensors with the REST API to view the sensor version on each endpoint.

Environment

• VMware Carbon Black EDR (EDR): All versions
• VMware Carbon Black Hosted EDR (Hosted EDR): All versions

Resolution

The /api/v1/sensor REST API call will return a JSON response with a list of sensors and related meta information. There is a field in the JSON response called "build_version_string" that contains a zero-padded version number that represents the sensor version installed on the endpoint. For example, a build_version_string "007.000.001.16744" indicates the 7.0.1.16744 sensor version. There is also an "os_environment_display_string" that contains the operating system version if needed.

Using the REST API requires authentication, so it is easiest to first log into the EDR server console UI. After login, modify the URL to include /api/v1/sensor (leave the domain portion of the URL). Additional parameters are added to the query to ensure that sensors with a pending uninstall request and previously uninstalled sensors are not included, as show below:

https://PRIMARY_NODE/api/v1/sensor?rows=10&start=0&uninstall=false&uninstalled=false

Please note that the rows parameter will need to be increased to accommodate your total sensor count, but this could lead to a performance impact with a large number of sensors. Alternatively, you can request a smaller number of rows over multiple queries and increment the start parameter with each query to denote which row to start returning results from.