CB Defense: Unable to get Sensor Uninstall Code using .../v3/device?hostname=

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• GET using .../v3/device?hostname={HostName} returns "uninstallCode" : null
• GET using .../v3/device/{DeviceID} returns correct "uninstallCode" for the same DeviceID

Environment

• PSC Console: All Versions
  • CB Defense
  • CB ThreatHunter
• CB Defense Devices API: v3

Cause

Query on Hostname returns 'null' as designed. Uninstall Code can only be pulled by querying on a single DeviceID.

Resolution

Improvements to the API are being worked on. This article will be updated when they are available.

Additional Information

Workaround via Console

1. Log into Console
2. Open Developer Tools (Chrome/Firefox) or Web Inspector (Safari)
3. Go to the Endpoints page
4. Set Status as desired (All shows all Sensors which have not been deleted)
5. Search for the desired Host-name
6. In DevTools/Web Inspector, look for the 'find' item and click Response tab*
7. Copy the information and format as JSON for simpler review**
8. Search for 'uninstallCode' to find device-specific codes for each device listed

*

Request URL: https://{dashboardURL}/appservices/v5/orgs/{OrgID}/devices/find
Request Method: POST

**Can also perform Find & Replace in a text editor so each line is a new DeviceID

Find: {"adGroupId":
Replace with: \r{"adGroupId":