Back to Blogs

Announcing the Alert Export API Endpoint

Posted on June 18, 2024

Overview

Carbon Black Cloud Alert Export enables up to 25,000 Alert records to be returned in CSV format using the API or from the Alerts page in the console.

The Export Alerts endpoint is asynchronous, allowing long running requests to be made.

  1. Use the Export Alerts endpoint to create a job with required search criteria to limit the results. A job_id is returned.
    • This job may take up to 5 minutes to complete.
  2. Optionally, use Get Job Progress to check whether the job has completed.
  3. Use the job_id in the Download Job Output endpoint in the Jobs Service to get the results. The Download Job API requires the permission jobs.status - READ.
    • If more than 25,000 records matched the criteria, the first 25,000 are returned, sorted by backend_timestamp in descending order.

Use Cases

  • Alerts are retained in Carbon Black Cloud for 180 days. Customers who need longer term records for compliance or reporting purposes can leverage Alert Export to generate a CSV on a regular basis.
  • Managed Detection & Response customers may want to retain a record of the MDR determination on every MDR-eligible alert. These alerts can be identified using mdr_alert in the export request: 
    "criteria": {
    "mdr_alert":true
}

Requirements

  • Carbon Black Cloud
  • API key with appropriate permissions. See Authentication for details.

More Information

Have questions or feedback?