CB Defense: Unable to get Sensor Uninstall Code using .../v3/device?hostname=
search cancel

CB Defense: Unable to get Sensor Uninstall Code using .../v3/device?hostname=

book

Article ID: 289878

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • GET using .../v3/device?hostname={HostName} returns "uninstallCode" : null
  • GET using .../v3/device/{DeviceID} returns correct "uninstallCode" for the same DeviceID

Environment

  • PSC Console: All Versions
    • CB Defense
    • CB ThreatHunter
  • CB Defense Devices API: v3

Cause

Query on Hostname returns 'null' as designed. Uninstall Code can only be pulled by querying on a single DeviceID.

Resolution

Improvements to the API are being worked on. This article will be updated when they are available.

Additional Information

Workaround via Console

  1. Log into Console
  2. Open Developer Tools (Chrome/Firefox) or Web Inspector (Safari)
  3. Go to the Endpoints page
  4. Set Status as desired (All shows all Sensors which have not been deleted)
  5. Search for the desired Host-name
  6. In DevTools/Web Inspector, look for the 'find' item and click Response tab*
  7. Copy the information and format as JSON for simpler review**
  8. Search for 'uninstallCode' to find device-specific codes for each device listed

*
Request URL: https://{dashboardURL}/appservices/v5/orgs/{OrgID}/devices/find
Request Method: POST
**Can also perform Find & Replace in a text editor so each line is a new DeviceID
Find: {"adGroupId":
Replace with: \r{"adGroupId":