Searching Raw Solr Documents Using Cbsearch
search cancel

Searching Raw Solr Documents Using Cbsearch

book

Article ID: 447185

calendar_today

Updated On:

Products

Carbon Black EDR

Issue/Introduction

How to utilize the cbsearch utility to collect raw solr document information. 

Environment

  • Carbon Black EDR Server: 7.9.1 and Higher

Resolution

Cbsearch utility

Run the utility directly on the primary server. The utility will reach out to each minion node to find the stored node. 

/usr/share/cb/cbsearch

 

Searching Switches

SwitchUseRequiredInfo

--process

--process <unique_id>Yes (only one base)Searches cbevents (reader) for the full raw process document
--binary--binary <md5 or sha256>Yes (only one base)Searches cbmodules core based on the hash provided
--feed--feed <id or name>Yes (only one base)Searches cbfeeds core based on the feed id or the feed name
--alert--alert <watchlist_id or feed report name> Yes (only one base)

Searches cbalerts core for alerts based on watchlist id or the report name.

Report name is the one found when clicking "threat reports", selecting the report and viewing the title at the top

 

Output Switches

SwitchUseRequiredInfo

--filename

--filename /tmp/myfile.jsonOptional

Allows a user to specify a path and filename

By default, base switches will use what is entered as the filename and saved to /var/log/cb/

When using --query, if nothing is specified it will output /var/log/cb/custom_query.json

--save--saveYes (can be combined)

Allows a user to save the output locally to /var/log/cb unless specified with --filename

Can be used with --post and --print

--post--postYes (can be combined)

Creates the file, submits it to Alliance and deletes it locally. To keep the file, use --save as well.

Use only for Broadcom direct or escalated cases. 

--print--printYes (can be combined)

Will print the output to the screen. Pro tip: use "--print --row 1" if you are testing a query and want to see what returns

 
 

Optional Switches

SwitchUseRequiredInfo
--query--query "myquery"Optional

Allows custom query search based on one of the above base switches

cbsearch --process --query "myquery"

Must be double quoted outside, and single quoted after the search terms. Can also be single quoted outside and double quoted inside

--row--row 50OptionalSpecify the row count (amount of documents to return).
--row-limit--row-limit 100Optional

Splits the query runs into smaller segments. By default this is limited to 5000.

For example: 600 rows, when row-limit is set to 100 the utility will run the query 6 times to get all 600, putting them in separate documents

 

Example Usage

TypeSearchInfo
Raw Process Documentcbsearch --process 00000035-0000-035c-01d9-73908e8da50d --save

Saves all raw process document segments matching that unique id into a local file. 
Debug tracking is enabled for this by default. 

Custom Process Search Querycbsearch --process --query 'process_name:parity.exe and netconn_count:[1 to *]' --save --row 10 --debug --filename /tmp/parity_capture.json

Runs the query "process_name:parity.exe and netconn_count:[1 to *]"
Only returns 10 documents. 
Saves to /tmp/parity_capture.json

Binary MD5/Sha256

cbsearch --binary C8214821278F83E9937798FD4C41A584 --print

cbsearch --binary 50420B826E802FAAED8928A74A044D8E8738785DBED93CFDB6080F92CF951435 --print 

Prints the binary document to standard out in terminal. 

The utility handles the case-sensitivity. It will accept lower or uppercase. 

Custom Binary Searchcbsearch --binary --query 'original_filename:"cbstream.sys" and product_name:"Carbon Black EDR Sensor"' --print --row 20

Prints 20 binaries matching the filename and product name. 

Feed Based IDcbsearch --feed 20 --row 1 --print

Printing a single feed report to the matched feed id of 20 to standard out in terminal

Feed Based Namecbsearch --feed bit9suspiciousindicators --print --row 1

Printing a single feed report to the matched bit9suspiciousindicators feed by name to standard out in terminal

Feed Querycbsearch --feed --query "title:mshtml.dll" --print --row 1

Searches like title will pick up on parts of the query, resulting in inaccurate results. So instead of 'title:Defense Evasion - Signed Binary Proxy Execution - mshtml.dll"', find something unique to the name like "title:mshtml.dll" to take advantage of the tokenization

Alert by Watchlist IDcbsearch --alert 32 --print --row 1

Printing a single match for an alert from watchlist 32 to standard out in terminal

Alert by Feed Report Namecbsearch --alert "'Matched yara rules: matchover100kb, matchStringforputty'" --print --row 1

Printing a single match for an alert based on the yara rule feed name to standard out in terminal

Custom Alert Querycbsearch --alert --query md5:a98d71eb1bec5d38549b2155a3e54008 --print --row 1

Printing a single match for alert based on this md5 to standard out in terminal

Additional Information

Powered by Wolken Software