Cb Defense: How to collect events for a specific endpoint

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• You want to collect events for a specific endpoint for Auditing or Incident Response Reasons

Environment

• PSC Web Console: All versions
• PSC Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Resolution

• At this time, you will need to use our APIs to get the event information you would like from the endpoint

Additional Information

• You can collect events from a specific endpoint using our API or our CbAPI Python Module
• Please refer to the links in the "Related Content" section below on how to get started, as well as examples.
• An idea has been submitted to provide event export functionality in the PSC. The link for this idea is in "Related Content".