Audit and Remediation: What is Live Query?

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

What is Live Query?

Environment

• Carbon Black Cloud Console: 0.38 Release and higher
  • Audit and Remediation
• Carbon Black Cloud Linux Sensor: 2.3.x.x and Higher
• Carbon Black Cloud macOS Sensor: 3.3.x.x and Higher
• Carbon Black Cloud Windows Sensor: 3.3.x.x and Higher

Resolution

Live Query is part of the Audit and Remediation (was CB LiveOps) offering for Carbon Black Cloud. Live Query is based on Osquery, which exposes an operating system as a high-performance relational database that can be queried for operating system data. Live Query allows the administrator to query current state/config/properties of one or more endpoints.

Additional Information

• Live Query uses SQL syntax to query for data, which is executed on the endpoint and returned to the backend and displayed on the Query Results page
• Live Query results can be exported from the Console UI as a CSV file
• Live Query results can be exported using the Audit & Remediation APIs in either JSON (default) or CSV formats