How to Get Raw Binary Documents via Cbsearch

Products

• Carbon Black EDR

Issue/Introduction

How to collect raw binary documents for support troubleshooting using the cbsearch utility. 

Environment

• Carbon Black EDR: 7.9.1 and Higher

Resolution

1. Open a backend terminal session with sudo privileges on the primary server.
2. Run this command with the unique id:

   /usr/share/cb/cbsearch --binary <md5 or sha256 hash> --save
   ex:
   /usr/share/cb/cbsearch --binary C8214821278F83E9937798FD4C41A584 --save

3. Collect the file and attach it to the support ticket. The file will be found in /var/log/cb/<hash>.json
4. The file can be removed upon successful upload. 

Additional Information

• Searching Raw Solr Documents Using Cbsearch
• How to Get Raw Process Documents via Cbsearch
• How to Get Raw Process Documents Via Curl
• How to Get Raw Process Documents Via Curl (Clustered)
• How to Get Raw Binary Documents Via Curl