How to write a CURL command to query for any string for the V6 Devices API.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

How to query using a CURL command for the Carbon Black Cloud V6 Device API for strings.

Environment

• Carbon Black Cloud Devices API: v6

Resolution

1. This curl command will return records that are both ACTIVE and have the string "default" (Note that the curl command is formatted for a Linux shell).

curl -H X-Auth-Token:{secret_token/org_id} "https://{defense.server.url.here}/appservices/v6/orgs/{org_key}/devices/_search/download?status=ACTIVE&query_string=%27default%27"

returns:

name,email,firstName,lastName,middleName,targetValue,status,registeredTime,deregisteredTime,lastContactTime,lastInternalIpAddress,lastExternalIpAddress,deviceType,policyName,windowsPlatform,osVersion,sensorVersion,avEngine,virtualMachine,virtualizationProvider,subDeploymentType,macAddress,avVdfVersion,groupName

"OpsPC","","","","",MEDIUM,ACTIVE,2016-08-25-194616,"",2016-08-25-194708,10.0.1.1,54.80.1.27,WINDOWS,"default","",XP x86,1.0.1.168,"",false,"","","","",""
"RelationsPC","","","","",MEDIUM,ACTIVE,2016-08-25-194617,"",2016-08-25-194747,10.0.2.2,54.80.1.27,MAC,"default","",MAC OS X 10.9.0,1.0.1.91,"",false,"","","","",""
"DevMac","","","","",MEDIUM,ACTIVE,2016-08-25-194620,"",2016-08-25-194814,10.0.3.3,54.80.1.1,MAC,"default","",MAC OS X 10.9.0,1.0.2.15,"",false,"","","","",""

 

Additional Information

• API Documentation is here. 
• For Windows 10 and Windows 2016, the curl command is built in.
• Use the "curl -v" option to troubleshoot connectivity and other possible issues as so:

curl -v -H X-Auth-Token:{secret_token/org_id} "https://{defense.server.url.here}/appservices/v6/orgs/{org_key}/devices/_search/download?status=ACTIVE&query_string=%27default%27"