Data Forwarder Fields

Environment

  • Carbon Black Cloud Console: December 2019 Release (0.51.0 backend) and Higher
  • CB Cloud Data Forwarder: All Versions
  • Amazon Simple Storage Service (Amazon S3)

Objective

This document describes how the Carbon Black Cloud Forwarders map field types into the output JSON format.

Data Types

Basic data types such as “int” and “string” map directly to the corresponding JSON data types. Additional data types are described below:

  • Base64 - JSON string containing base64 encoded binary data.
  • Ipaddr - JSON string containing canonically formatted IPv4 or IPv6 address.
  • Datetime - JSON string containing ISO 8601 date/time format. If no time zone is included, UTC is assumed. All timestamps emitted by the Data Forwarder are sent in ISO 8601 format.
  • String enum - JSON string containing the stringified version of the enum from the relevant protobuf field, with the common prefix stripped off. For example, “BLOCK”.
  • String enum bitmask - Same as above, but for bitmask input fields, add OR " | " markers between each set bit. For example, for a CbFileAction of 0x300 would be “OPEN_READ | OPEN_WRITE”.

Event Fields

“Common fields” are present in all event types, while other fields are only present for a specific event type.

Legend:

  • FILTERABLE - Indicates whether the field is supported in the query for a filter
  • TOKENIZED - The field supports partial phrase matching through Tokenization
  • WILDCARD - The field supports wildcard characters

Common Fields

The Carbon Black Cloud Data Forwarder emits a set of common fields for every endpoint event. These fields represent common metadata for the organization, device, and process to which this event belongs.

Note: A new copy of the alert will be sent if something changes on the backend.
Field Definition Capabilities
action Specific endpoint action observed by sensor during this event. Enum values vary by event type FILTERABLE
backend_timestamp Time when the backend received the batch of events, based on Carbon Black Cloud backend’s clock as an RFC 3339 formatted time string based on UTC to the seconds; may differ from device_timestamp by a few minutes due to asynchronous processing

Example: 2021-07-28 18:43:51 +0000 UTC
device_group Sensor group to which the endpoint was assigned when the sensor recorded the event data FILTERABLE WILDCARD
device_id Integer ID of the device that created this event FILTERABLE
device_name Hostname of the device that created this event FILTERABLE WILDCARD
device_os OS Type of device (Windows/OSX/Linux) FILTERABLE
device_timestamp Time seen on sensor, based on sensor’s clock in RFC 3339 UTC format to seconds

Example: 2021-07-28 18:43:51 +0000 UTC
event_origin Indicates which product the event came from.
“EDR” indicates the event originated from Enterprise EDR.
“NGAV” indicates the event originated from Endpoint Standard.		 FILTERABLE
org_key The organization key associated with the console instance. Can be used to disambiguate events from different Carbon Black Cloud tenant organizations. FILTERABLE WILDCARD
parent_guid Unique ID of parent process. Please see this document for more information on how a process GUID is used and each of its components.
parent_hash Cryptographic hashes of the executable file backing the parent process, represented as an array of two elements - MD5 and SHA-256 hash FILTERABLE
parent_path Full path to the executable file backing the parent process on the device’s file system FILTERABLE WILDCARD
parent_pid OS-reported Process ID of the parent process FILTERABLE
parent_reputation Reputation of the parent process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud FILTERABLE
process_cmdline Command line executed by the actor process FILTERABLE TOKENIZED WILDCARD
process_fork_pid The PID of a process forked from the actor on *nix systems. If f process_pid != process_fork_pid, the current process was forked from original process_pid. FILTERABLE
process_guid Unique ID of process. Please see this document for more information on how a process GUID is used and each of its components.
process_hash Cryptographic hashes of the executable file backing this process, represented as an array of two elements - MD5 and SHA-256 hash FILTERABLE
process_path Full path to the executable file backing this process on the device’s file system FILTERABLE WILDCARD
process_pid OS-reported Process ID of the current process FILTERABLE
process_reputation Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud FILTERABLE
process_username The username associated with the user context that this process was started under FILTERABLE WILDCARD
schema The schema version. The current schema version is “1”. This schema version will only be incremented if the field definitions are changed in a backwards-incompatible way. New fields in an event type or new event types will not result in a new schema version. FILTERABLE
sensor_action (optional) Included if the sensor blocked the event or terminated the application due to security policy

POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY		 FILTERABLE
target_cmdline Process command line associated with the target process FILTERABLE TOKENIZED WILDCARD
type The event type. Use this field to determine which fields should be expected per the specs below. FILTERABLE

Endpoint Standard Fields

Endpoint Standard events have the event_origin field set to NGAV. If you are an Endpoint Standard customer, you will see the below fields populated in the Data Forwarder output. Enterprise EDR fields will also be present, but not populated. Endpoint Standard records only “security-relevant” events, so you will see roughly 10-20x fewer Endpoint Standard events than Enterprise EDR events.

Field Definition Capabilities
alert_id The ID of the Alert this event is associated with FILTERABLE
device_external_ip IP address of the host as seen by the backend (the public IPv4 or IPv6 address used to contact the Carbon Black Cloud) FILTERABLE
event_description Long textual description of the event as seen in the Carbon Black Cloud web console FILTERABLE WILDCARD
event_id Internal Endpoint Standard event ID associated with this specific event ⁠— this event ID can be used to find the specific event in the Carbon Black Cloud web console
process_terminated Always FALSE for Endpoint Standard events

Enterprise EDR Fields

Enterprise EDR events have the event_origin field set to EDR. Endpoint Standard fields will be present, but not populated.

Field Definition Capabilities
parent_cmdline Process command line associated with the parent process FILTERABLE TOKENIZED WILDCARD
process_duration The time difference in seconds between the process start and process terminate event
process_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the process as reported by the endpoint FILTERABLE WILDCARD

Filterable field: process_publisher
process_publisher[]
.state		 See above FILTERABLE

Filterable field: process_publisher_state
process_terminated True if process was terminated

API Call

endpoint.event.apicall

Each API-call event is reported as the type “endpoint.event.apicall”. An API-call event includes the fields named in the “Common Fields” section above.

Field Definition Capabilities
crossproc_api Name of the operating system API called by the actor process. In cases where that call targets another process, that process is reported as crossproc_name. In cases where there is no target process, this field represents a system API call.

Available with:
  • all sensors with Endpoint Standard
  • Windows 3.8 or later sensor with Enterprise EDR
  • macOS sensors with Enterprise EDR (only reporting the PEP_CREATE_PHANDLE_API call made in task_for_pid() requests)
 FILTERABLE WILDCARD
crossproc_action The cross-process action initiated by the actor process

ACTION_API_CALL, ACTION_DUP_PROCESS_HANDLE, ACTION_OPEN_THREAD_HANDLE, ACTION_DUP_THREAD_HANDLE, ACTION_CREATE_REMOTE_THREAD		 FILTERABLE

Cross-Process Event

endpoint.event.crossproc

Any time a process interacts with another process on the system, that is considered a “cross-process” event. Each cross-process event is reported as the type “endpoint.event.crossproc”. The following fields represent metadata associated with the cross-process event.

Field Definition Capabilities
crossproc_api Name of the operating system API called by the actor process. In cases where that call targets another process, that process is reported as crossproc_name. In cases where there is no target process, this field represents a system API call.

Available with:
  • all sensors with Endpoint Standard
  • Windows 3.8 or later sensor with Enterprise EDR
  • macOS sensors with Enterprise EDR (only reporting the PEP_CREATE_PHANDLE_API call made in task_for_pid() requests)
 FILTERABLE WILDCARD
crossproc_action The cross-process action initiated by the actor process

ACTION_API_CALL, ACTION_DUP_PROCESS_HANDLE, ACTION_OPEN_THREAD_HANDLE, ACTION_DUP_THREAD_HANDLE, ACTION_CREATE_REMOTE_THREAD		 FILTERABLE
crossproc_guid Unique ID of the cross process
crossproc_hash Cryptographic hashes of the target of the crossproc event ⁠— this is represented as an array of two elements, MD5 and SHA-256 hash FILTERABLE
crossproc_name Full path to the target of the crossproc event on the device’s local file system FILTERABLE WILDCARD
crossproc_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the crossproc as reported by the endpoint FILTERABLE WILDCARD

Filterable field: crossproc_publisher
crossproc_publisher[]
.state		 See above FILTERABLE

Filterable field: crossproc_publisher_state
crossproc_reputation Carbon Black Cloud Reputation string for the crossproc. FILTERABLE
crossproc_target True if the process was the target of the cross-process event; false if the process was the actor FILTERABLE

File Modification

endpoint.event.filemod

Each file-modification event is reported as the type “endpoint.event.filemod”. The following fields represent metadata associated with the file-modification event.

Field Definition Capabilities
filemod_hash Cryptographic hashes of the file modified ⁠— this is represented as an array of two elements, MD5 and SHA-256 hash FILTERABLE
filemod_name Full path to the file being modified on the device’s file system FILTERABLE WILDCARD

Fileless Script Load

endpoint.event.fileless_scriptload

A “fileless script load” is generated when a process loads a set of script instructions into memory. Each fileless script load event is reported as the type “endpoint.event.fileless_scriptload”. The following fields represent metadata associated with the fileless script load event.

Field Definition Capabilities
fileless_scriptload_cmdline Deobfuscated script content run in a fileless context by the process FILTERABLE TOKENIZED WILDCARD
fileless_scriptload_cmdline_length Character count of the deobfuscated script content run in a fileless context FILTERABLE
fileless_scriptload_hash SHA-256 hash(es) of the deobfuscated script content run by the process in a fileless context FILTERABLE

Module Load

endpoint.event.moduleload

A “module load” is generated when a process loads a shared library (DLL in Windows, .so in Linux, .dylib in macOS) into its process memory space. Each module load event is reported as the type “endpoint.event.moduleload”. The following fields represent metadata associated with the module load event.

Field Definition Capabilities
modload_count Count of modload events reported by the sensor since last initialization FILTERABLE
modload_effective_reputation Effective reputation(s) of the loaded module(s); applied by the sensor when the event occurred FILTERABLE
modload_hash MD5 or SHA-256 hash(es) of the module(s) loaded by the process FILTERABLE
modload_md5 MD5 hash of the module loaded by the process FILTERABLE
modload_name Full path to the module being loaded on the device’s file system FILTERABLE WILDCARD
modload_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the moduleload as reported by the endpoint FILTERABLE WILDCARD

Filterable field: modload_publisher
modload_publisher[]
.state		 See above FILTERABLE

Filterable field: modload_publisher_state
modload_sha256 SHA-256 hash of the module loaded by the process FILTERABLE

Network Connection

endpoint.event.netconn

Each network-connection event is reported as the type “endpoint.event.netconn”. In addition to the common fields documented in “Common Fields”, the following fields represent metadata associated with the network-connection event.

Field Definition Capabilities
local_ip IPv4 or IPv6 address in string format associated with the “local” end of this network connection FILTERABLE
local_port UDP/TCP port number associated with the “local” end of this network connection FILTERABLE
netconn_domain DNS name associated with the “remote” end of this network connection ⁠— may be empty if the name cannot be inferred or the connection is made direct to/from a remote IP address FILTERABLE WILDCARD
netconn_inbound Set to true if the netconn is inbound FILTERABLE
netconn_protocol String UDP or TCP protocol identifier FILTERABLE
remote_ip IPv4 or IPv6 address in string format associated with the “remote” end of this network connection FILTERABLE
remote_port UDP/TCP port number associated with the “remote” end of this network connection FILTERABLE

Network Proxy Connection

endpoint.event.netconn_proxy

A “network proxy connection” event is any network connection event in which the process communicates with an intermediary remote device but has a different intended destination - usually an HTTP proxy intermediary. Each network proxy connection event is reported as the type “endpoint.event.netconn_proxy”. In addition to the common fields documented in “Common Fields” as well as the fields documented in “Network Connection - endpoint.event.netconn”, the following fields represent metadata associated with the network proxy connection event.

Field Definition Capabilities
netconn_proxy_domain DNS name associated with the “proxy” end of this network connection ⁠— may be empty if the name cannot be inferred or the connection is made direct to/from a proxy IP address FILTERABLE WILDCARD
netconn_proxy_ip IPv4 or IPv6 address in string format associated with the “proxy” end of this network connection FILTERABLE
netconn_proxy_port UDP/TCP port number associated with the “proxy” end of this network connection FILTERABLE

Process Launch Event

endpoint.event.procstart

Each process launch event is reported as the type “endpoint.event.procstart”. A procstart event can be either a child process or a new process. A child process event will have the action ACTION_CREATE_PROCESS where a new process will have ACTION_PROCESS_DISCOVERED. In the case of a new process you will only have process and childproc properties, there will be no parent properties. The child process properties represent the process being created and the process properties will represent the os system.

The target_cmdline property is the command line that was executed to create the process represented in the childproc properties.

In addition to the common fields documented in “Common Fields”, the following fields represent metadata associated with the process start event.

Field Definition Capabilities
childproc_guid Unique ID of the child process. See this document for more information on how a process GUID is used and each of its components.
childproc_hash Cryptographic hashes of the executable file backing the child process, represented as an array of two elements - MD5 and SHA-256 hash FILTERABLE
childproc_name Full path to the target application for the child process on the device’s local file system FILTERABLE WILDCARD
childproc_pid OS-reported Process ID of the child process FILTERABLE
childproc_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the childproc as reported by the endpoint FILTERABLE WILDCARD

Filterable field: childproc_publisher
childproc_publisher[]
.state		 See above FILTERABLE

Filterable field: childproc_publisher_state
childproc_reputation Carbon Black Cloud Reputation string for the childproc. FILTERABLE
childproc_username The username associated with the user context that the child process was started under FILTERABLE WILDCARD

Process Terminate Event

endpoint.event.procend

Each process-terminate event is reported as the type “endpoint.event.procend”. A “procend” event includes the fields named in the “Common Fields” section above.

Registry Modification

endpoint.event.regmod

Each registry-modification event is reported as the type “endpoint.event.regmod”. The following fields represent metadata associated with the registry-modification event.

Field Definition Capabilities
regmod_name Full path to the registry key, including the hive, being modified on the Windows device’s registry FILTERABLE WILDCARD

Script Load

endpoint.event.scriptload

A “script load” is generated when a process loads a script (.ps1, .vb, .bin, etc..) that can be executed by a script interpreter. Each script load event is reported as the type “endpoint.event.scriptload”. The following fields represent metadata associated with the script load event.

EDR Scriptload Event

Field Definition Capabilities
scriptload_effective_reputation Effective reputation(s) of the loaded script(s); applied by the sensor when the event occurred

Requires Windows CBC sensor version 3.5 or later, macOS CBC sensor version 3.4 or later and Enterprise EDR

ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST		 FILTERABLE
scriptload_hash MD5 and/or SHA-256 hash(es) of the filesystem script file loaded at process launch FILTERABLE
scriptload_name Filesystem path of script file(s) loaded at process launch FILTERABLE WILDCARD
scriptload_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the scriptload as reported by the endpoint FILTERABLE WILDCARD

Filterable field: scriptload_publisher
scriptload_publisher[]
.state		 See above FILTERABLE

Filterable field: scriptload_publisher_state
scriptload_reputation Reputation(s) of the loaded script(s); applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud

Requires Windows CBC sensor version 3.5 or later, macOS CBC sensor version 3.4 or later and Enterprise EDR

ADAPTIVE_WHITE_LIST, ADWARE, COMMON_WHITE_LIST, COMPANY_BLACK_LIST, COMPANY_WHITE_LIST, HEURISTIC, IGNORE, KNOWN_MALWARE, LOCAL_WHITE, NOT_LISTED, PUP, RESOLVING, SUSPECT_MALWARE, TRUSTED_WHITE_LIST		 FILTERABLE

NGAV Scriptload Event

Field Definition Capabilities
process_loaded_script_hash SHA-256 hash(es) of any script loaded from the filesystem through the duration of the process; compare with fileless_scriptload_hash m FILTERABLE
process_loaded_script_name Filesystem path(s) of any script content loaded from the filesystem through the duration of the process; compare with fileless_scriptload_cmdline, scriptload_content FILTERABLE WILDCARD
scriptload_content Deobfuscated script content (string, binary, or raw executable image) loaded from the filesystem at process launch; compare with fileless_scriptload_cmdline, process_loaded_script_name

Requires Windows CBC sensor 3.6 or later, AMSI support via Windows 10/Server version 1703 or later and Endpoint Standard product

For more information see here		 FILTERABLE
scriptload_count Count of scriptload events across all processes reported by the sensor since last initialization FILTERABLE
scriptload_hash MD5 and/or SHA-256 hash(es) of the filesystem script file loaded at process launch FILTERABLE
scriptload_name Filesystem path of script file(s) loaded at process launch FILTERABLE WILDCARD
scriptload_content_length Character count of the deobfuscated filesystem script; compare with fileless_scriptload_cmdline_length

Requires Windows CBC sensor 3.6 or later, AMSI support via Windows 10/Server version 1703 or later and Endpoint Standard product

For more information see here		 FILTERABLE

Volume Event

endpoint.event.volume

Events generated for volume operations, including mounting and un-mounting of external devices. A “volume” event includes the fields named in the “Common Fields” section above.

Alert Fields

“Common fields” are present in all alert types, while other fields are only present for a specific alert type.

Common Fields

The Data Forwarder emits a set of common fields for every alert. These fields represent common metadata for the customer, device, and alert.

Field Definition
alert_url A redirect link to refer back to the Carbon Black Cloud console. CB_ANALYTICS alerts will redirect to the Alert Triage page for the specific alert. WATCHLIST alerts will redirect to the Investigate page for the specific alert. DEVICE_CONTROL and CONTAINER_RUNTIME alerts will redirect to the Alerts page.
category Type of alert

WARNING, NOTICE

Note: The values differ from the Alerts API where 'WARNING' is 'THREAT' and 'NOTICE' is 'MONITORED'.
create_time The time the alert was created in ISO 8601 UTC timestamp format to milliseconds

Example: 2021-07-28T18:38:41.000Z
device_external_ip IP address of the endpoint from the perspective of the Carbon Black Cloud. Can differ from device_internal_ip due to network proxy or NAT. Can be either IPv4 (dotted decimal notation, e.g. “10.0.103.101”) or IPv6 (proprietary format, e.g. “62e0:00f9:ccde:8fc4:c0c2:e0bd:a8fe:0726”)
device_id Integer ID of the device that created this alert (Always empty for Container Runtime alerts)
device_internal_ip IP address of the endpoint as reported by the sensor. Can be either IPv4 (dotted decimal notation, e.g. “10.0.103.101”) or IPv6 (proprietary format, e.g. “62e0:00f9:ccde:8fc4:c0c2:e0bd:a8fe:0726”) (Always empty for Container Runtime alerts)
device_name Hostname of the device that created this alert (Always empty for Container Runtime alerts)
device_os OS Type of device (Windows/OSX/Linux) (Always empty for Container Runtime alerts)
device_os_version Version of OS on device (Windows 10 x64) (Always empty for Container Runtime alerts)
device_uem_id “Unified Endpoint Management” identifier assigned by VMware Workspace ONE Intelligence, only populated if the Workspace ONE integration is configured. Unique across Carbon Black Cloud in GUID format (e.g. “FC3992EE-A8CD-5AD5-AC6D-A477490456E4”) (Always empty for Container Runtime alerts)
device_username Name of the user that installed the device. To get the actual user involved in the device alert, get the underlying event or process data. (Always empty for Container Runtime alerts)
first_event_time The time the first event associated with the alert was seen in ISO 8601 UTC format to seconds

Example: 2021-07-28T17:38:47Z
id The unique long id of the alert
last_event_time The time the most recent event associated with the alert was seen in ISO 8601 UTC format to seconds

Example: 2021-07-28T17:38:47Z
last_update_time The time the alert was last updated in ISO 8601 UTC format to seconds

Example: 2021-07-28T17:38:47Z
legacy_alert_id The unique short id of the alert
notes_present True if notes are associated with the alert
org_key The organization key associated with the console instance. Can be used to disambiguate alerts from different customers/organizations.
policy_id ID associated with the policy that triggered the alert
policy_name Name of the policy that triggered the alert
severity The severity of the alert
tags A list of tags associated with the alert
target_value Device priority as assigned via the policy

LOW, MEDIUM, HIGH, CRITICAL
threat_id ID of the threat to which this alert belongs
type The alert type. Use this field to determine which fields should be expected per the specs below.

CB_ANALYTICS, DEVICE_CONTROL, WATCHLIST, CONTAINER_RUNTIME
workflow Tracking system for alerts as they are triaged and resolved

CB Analytics

Field Definition
blocked_threat_category The category of threat which were not able to take action

UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM
created_by_event_id The ID of the event that created the alert
device_location The location of the device

ONSITE, OFFSITE, UNKNOWN
kill_chain_status Phase of the Cyber Kill Chain the alert represents
not_blocked_threat_category Other potentially malicious activity involved in the threat that were able to take action either due to policy config, or not having a relevant rule

UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM
policy_applied Whether a policy was applied
process_name Name executable file backing this process on the device’s file system
reason Description of the alert
reason_code Shorthand enum for the full-text reason
run_state Whether the threat in the alert actually ran

DID_NOT_RUN, RAN, UNKNOWN
sensor_action The action taken by the sensor, according to the rules of the policy

POLICY_NOT_APPLIED, ALLOW, ALLOW_AND_LOG, TERMINATE, DENY
threat_activity_c2 Whether the alert involved a c2 server

NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED
threat_activity_dlp Whether the alert involved DLP

NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED
threat_activity_phish Whether the alert involved phishing

NOT_ATTEMPTED, ATTEMPTED, SUCCEEDED
threat_cause_actor_name The name can be one of the following: process commandline, process path, process name, or analytic matched threat. Analytic matched threats are Exploit, Malware, PUP, or Trojan
threat_cause_actor_process_pid PID of the actor process
threat_cause_actor_sha256 SHA256 or remote IP of the threat cause actor. The actor will be a remote IP when the alert is created from a netconn event
threat_cause_cause_event_id Event ID that triggered the event
threat_cause_reputation Reputation of the threat cause
threat_cause_threat_category Threat category

UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM
threat_cause_vector Source of the threat cause
threat_indicators List of the threat indicators that make up the threat

Container Runtime

Field Definition
cluster_name Name of the K8s cluster associated with the alert
connection_type Type of connection

INGRESS, EGRESS, INTERNAL_INBOUND, INTERNAL_OUTBOUND
egress_group_id ID of the egress group
egress_group_name Name of the egress group
ip_reputation Reputation assigned by Carbon Black Cloud; ranges 1-100, where 100 is “trustworthy”
namespace Namespace within the K8s cluster associated with the alert
port Listening port; remote or local
protocol Name of the protocol

Example values: HTTP, TLS, TCP, TELNET, SSH
remote_domain Name of the remote domain
remote_ip IP address of the remote side
remote_is_private Type of remote IP: public or private (“private” means within the cluster or the org’s network; “public” means outside of the cluster and the org’s network)

TRUE, FALSE
remote_namespace Namespace within the remote workload’s cluster; set if the remote side is another workload in the same cluster
remote_replica_id Remote workload replica ID; set if the remote side is another workload in the same cluster
remote_workload_id ID of the remote workload; set if the remote side is another workload in the same cluster
remote_workload_kind Kind of remote workload; set if the remote side is another workload in the same cluster
remote_workload_name Name of the remote workload; set if the remote side is another workload in the same cluster
replica_id Name of the pod within a workload
rule_id Unique identifier for the K8s policy rule
rule_name Name of the K8s policy rule
workload_id ID of the workload within a specific cluster_name/namespace pair
workload_kind Type of workload; Pod, Deployment, Job, etc.
workload_name Name of the workload within a cluster_name/namespace pair

Device Control

Field Definition
device_location The location of the device

ONSITE, OFFSITE, UNKNOWN
external_device_friendly_name The human readable USB device name
policy_applied Whether a policy was applied
product_id The hexadecimal id of the USB device’s product
product_name The name of the USB device’s product
reason Description of the alert
reason_code Shorthand enum for the full-text reason
run_state Whether the threat in the alert actually ran

DID_NOT_RUN, RAN, UNKNOWN
serial_number The serial number of the USB device
threat_cause_cause_event_id Event ID that triggered the event
threat_cause_threat_category Threat category

UNKNOWN, NON_MALWARE, NEW_MALWARE, KNOWN_MALWARE, RISKY_PROGRAM
threat_cause_vector Source of the threat cause
vendor_name The name of the USB device’s vendor
vendor_id The hexadecimal id of the USB device’s vendor

Watchlist

Field Definition
ioc_id ID of the IOC that caused the hit
ioc_field Field name corresponding to the value returned by ioc_hit (only returned for equality IOCs)
ioc_hit IOC field value, or IOC query that matches
process_guid Unique ID of process
process_path Tokenized path of the process’ binary
report_id Id of the report that generated a hit on the process
report_name Name of the report that generated a hit on the process
reason_code GUID string
run_state Run state is always RAN for watchlist alerts
threat_cause_actor_name The process path of the threat actor
threat_cause_actor_process_pid PID of the actor process
threat_cause_actor_sha256 SHA256 or remote IP of the threat cause actor. The actor will be a remote IP when the alert is created from a netconn event
threat_cause_cause_event_id Event ID that triggered the event
threat_cause_reputation Reputation of the threat cause
threat_cause_threat_category Category of the threat cause
threat_cause_vector The source of the threat cause
threat_indicators List of the threat indicators that make up the threat
watchlists List of watchlists associated with an alert

Watchlist Hit Fields

The Carbon Black Cloud Data Forwarder emits a set of fields for every watchlist hit. These fields represent metadata for the organization, device, process, ioc, report and watchlist to which the hit belongs.

Field Definition
alert_id The ID of the Alert this watchlist hit is associated with
create_time The time the watchlist hit was created in ISO 8601 UTC timestamp format to milliseconds

Example: 2021-07-28T18:38:41.000Z
device_external_ip IP address of the endpoint from the perspective of the Carbon Black Cloud. Can differ from device_internal_ip due to network proxy or NAT. Can be either IPv4 (dotted decimal notation, e.g. “10.0.103.101”) or IPv6 (proprietary format, e.g. “62e0:00f9:ccde:8fc4:c0c2:e0bd:a8fe:0726”)
device_id Integer ID of the device that created this watchlist hit
device_internal_ip IP address of the endpoint as reported by the sensor. Can be either IPv4 (dotted decimal notation, e.g. “10.0.103.101”) or IPv6 (proprietary format, e.g. “62e0:00f9:ccde:8fc4:c0c2:e0bd:a8fe:0726”)
device_name Hostname of the device that created this watchlist hit
device_os OS Type of device (Windows/OSX/Linux)
device_uem_id “Unified Endpoint Management” identifier assigned by VMware Workspace ONE Intelligence, only populated if the Workspace ONE integration is configured. Unique across Carbon Black Cloud in GUID format (e.g. “FC3992EE-A8CD-5AD5-AC6D-A477490456E4”)
ioc_field Field the IOC hit contains
ioc_hit IOC field value, or IOC query that matches
ioc_id ID of the IOC that caused the hit
org_key The organization key associated with the console instance. Can be used to disambiguate alerts from different customers/organizations.
parent_cmdline Command line executed by the parent process
parent_guid Unique ID of parent process. Please see this document for more information on how a process GUID is used and each of its components.
parent_hash Cryptographic hashes of the executable file backing the parent process, represented as an array of two elements - MD5 and SHA-256 hash
parent_path Full path to the executable file backing the parent process on the device’s file system
parent_pid OS-reported Process ID of the parent process
parent_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the process as reported by the endpoint
parent_publisher[]
.state		 See above
parent_reputation Reputation of the parent process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud
parent_username The username associated with the user context that the parent process was started under
process_cmdline Command line executed by the actor process
process_guid Unique ID of process. Please see this document for more information on how a process GUID is used and each of its components.
process_hash Cryptographic hashes of the executable file backing this process, represented as an array of two elements - MD5 and SHA-256 hash
process_path Full path to the executable file backing this process on the device’s file system
process_pid OS-reported Process ID of the current process
process_publisher[]
.name		 Array with objects of two keys: “name” and “state”. Each array entry is a signature entry for the process as reported by the endpoint
process_publisher[]
.state		 See above
process_reputation Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud
process_username The username associated with the user context that this process was started under
report_id ID of the watchlist report(s) that detected a hit on the process
report_name Name of the watchlist report(s) that detected a hit on the process
report_tags List of tags associated with the report(s) that detected a hit on the process
severity The severity of the watchlist hit
type The watchlist hit type

watchlist.hit
watchlists List of watchlists that contain the report of the ioc hit

Data Samples

The following are samples of data: endpoint.event, Watchlist Alert, CB ANALYTICS Alert.

endpoint.event

{
  "type": "endpoint.event.procstart",
  "process_guid": "ABCD1234-006e8d46-00001310-00000000-1d5fd46cc37d700",
  "parent_guid": "ABCD1234-006e8d46-00000290-00000000-1d5fa5dbbaa12ce",
  "backend_timestamp": "2020-03-25 22:38:54 +0000 UTC",
  "org_key": "ABCD1234",
  "device_id": "7245126",
  "device_name": "cbc-win10",
  "device_external_ip": "72.152.92.146",
  "device_os": "WINDOWS",
  "device_group": "Windows Group",
  "action": "ACTION_CREATE_PROCESS",
  "schema": 1,
  "event_description": "The application \"<share><link hash=\"0f407d7194e7955e312b177b16cc409ac89b4d0494c60ce75469fd4c474d4043\">C:\\program files (x86)\\google\\chrome\\application\\chrome.exe</link></share>\" invoked the application \"<share><link hash=\"0f407d7194e7955e312b177b16cc409ac89b4d0494c60ce75469fd4c474d4043\">C:\\program files (x86)\\google\\chrome\\application\\chrome.exe</link></share>\". ",
  "alert_id": "WXYZ0987",
  "event_id": "54885ebc6ee911eabc70416f8358e4f2",
  "device_timestamp": "2020-03-25 22:38:03.353 +0000 UTC",
  "process_terminated": false,
  "process_reputation": "REP_RESOLVING",
  "parent_repuation": "",
  "process_pid": 4880,
  "parent_pid": 656,
  "process_publisher": [
    {
      "name": "Google Inc",
      "state": "FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED"
    }
  ],
  "process_path": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
  "parent_path": "c:\\windows\\system32\\services.exe",
  "process_hash": [
    "3623a0e7cdcf3310ffb4c87c5b43ae02",
    "0f407d7194e7955e312b177b16cc409ac89b4d0494c60ce75469fd4c474d4043"
  ],
  "parent_hash": [
    "db896369fb58241adf28515e3765c514",
    "a2e369df26c88015fe1f97c7542d6023b5b1e4830c25f94819507ee5bcb1dfcc"
  ],
  "process_cmdline": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --flag-switches-begin --flag-switches-end --enable-audio-service-sandbox",
  "parent_cmdline": "",
  "process_username": "CBC-WIN10\\user",
  "sensor_action": "ALLOW",
  "childproc_name": "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe",
  "childproc_hash": [
    "3623a0e7cdcf3310ffb4c87c5b43ae02",
    "0f407d7194e7955e312b177b16cc409ac89b4d0494c60ce75469fd4c474d4043"
  ],
  "target_cmdline": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --type=utility --field-trial-handle=1656,13710686576560040528,13403776044656688818,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=5236 --ignored=\" --type=renderer \" /prefetch:8"
}

Alerts

WATCHLIST

{
  "type": "WATCHLIST",
  "id": "951d536a-2817-4790-8c97-c2d31624de7c",
  "legacy_alert_id": "ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613-BC154984541016AFD2467DF221AA20FD",
  "org_key": "ABCD1234",
  "create_time": "2021-01-04T23:33:32Z",
  "last_update_time": "2021-01-04T23:33:32Z",
  "first_event_time": "2021-01-04T23:25:58Z",
  "last_event_time": "2021-01-04T23:25:58Z",
  "threat_id": "A22D9AFD42B85FF4FE6C8AE1DB6FBD6C",
  "severity": 7,
  "category": "WARNING",
  "device_id": 3775337,
  "device_os": "WINDOWS",
  "device_name": "CBcloud-win10",
  "device_username": "admin",
  "policy_id": 6525,
  "policy_name": "default",
  "target_value": "MEDIUM",
  "workflow": {
    "state": "OPEN",
    "remediation": "",
    "last_update_time": "2021-01-04T23:32:19Z",
    "comment": "",
    "changed_by": "Carbon Black"
  },
  "device_internal_ip": "123.45.67.890",
  "device_external_ip": "23.45.67.89",
  "alert_url": "https://defense.conferdeploy.net/cb/investigate/processes?orgId=123\u0026query=alert_id%3A951d536a-2817-4790-8c97-c2d31624de7c+AND+device_id%3A3775337\u0026searchWindow=ALL",
  "reason_code": "Process powershell.exe was detected by the report \"Execution - PowerShell Downloading Behaviors Detected\" in watchlist \"Carbon Black Advanced Threats\"",
  "process_name": "powershell.exe",
  "threat_indicators": [{
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["e41b000e-eb5a-41f4-aa67-1902d186a457-0"]
  }],
  "threat_cause_actor_sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
  "threat_cause_actor_name": "powershell.exe",
  "threat_cause_reputation": "COMMON_WHITE_LIST",
  "threat_cause_threat_category": "RESPONSE_WATCHLIST",
  "threat_cause_vector": "UNKNOWN",
  "run_state": "RAN",
  "ioc_id": "e41b000e-eb5a-41f4-aa67-1902d186a457-0",
  "ioc_hit": "(process_cmdline:powershell* AND (process_cmdline:.downloaddata OR process_cmdline:.downloadstring OR process_cmdline:.downloadfile) -process_cmdline:chocolatey.org*) -enriched:true",
  "watchlists": [{
    "id": "mrTB06fAQbeNfvl47cQiGg",
    "name": "Carbon Black Advanced Threats"
  }],
  "process_guid": "ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613",
  "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
  "report_name": "Execution - PowerShell Downloading Behaviors Detected",
  "report_id": "MLRtPcpQGKFh5OE4BT3tQ-e41b000e-eb5a-41f4-aa67-1902d186a457",
  "status": "UNRESOLVED"
}

CB_ANALYTICS

{
  "type": "CB_ANALYTICS",
  "id": "36259335daf0f2c4edb11ebb2828b41ebaf3867",
  "legacy_alert_id": "ZHGKP3EM",
  "org_key": "ABCD1234",
  "create_time": "2021-01-04T22:22:52Z",
  "last_update_time": "2021-01-04T22:23:05Z",
  "first_event_time": "2021-01-04T22:22:42Z",
  "last_event_time": "2021-01-04T22:22:42Z",
  "threat_id": "f7959830dfea89252d459b056ab43222",
  "severity": 4,
  "category": "NOTICE",
  "device_id": 3625933,
  "device_os": "WINDOWS",
  "device_os_version": "Windows 10 x64",
  "device_name": "win10-ps-moid",
  "device_username": "jdoe@carbonblack.com",
  "policy_id": 6525,
  "policy_name": "default",
  "target_value": "MEDIUM",
  "workflow": {
    "state": "OPEN",
    "remediation": "",
    "last_update_time": "2021-01-04T22:22:52Z",
    "comment": "",
    "changed_by": "Carbon Black"
  },
  "device_internal_ip": "123.45.67.890"
  "device_external_ip": "23.45.67.89",
  "alert_url": "https://defense.conferdeploy.net/triage?incidentId=ZHGKP3EM\u0026orgId=123",
  "reason": "The application powershell.exe is executing a fileless script or command.",
  "reason_code": "R_FILELESS",
  "process_name": "powershell.exe",
  "device_location": "OFFSITE",
  "created_by_event_id": "5daf0f2c4edb11ebb2828b41ebaf3867",
  "threat_indicators": [{
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["MODIFY_MEMORY_PROTECTION"]
  }, {
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["MITRE_T1059_CMD_LINE_OR_SCRIPT_INTER"]
  }, {
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["FILELESS"]
  }, {
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["MITRE_T1057_PROCESS_DISCOVERY"]
  }, {
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["CODE_DROP"]
  }, {
    "process_name": "powershell.exe",
    "sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
    "ttps": ["ENUMERATE_PROCESSES"]
  }],
  "threat_cause_actor_sha256": "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53",
  "threat_cause_actor_name": "powershell.exe",
  "threat_cause_actor_process_pid": "3292-132541831999374961-0",
  "threat_cause_reputation": "COMMON_WHITE_LIST",
  "threat_cause_threat_category": "NON_MALWARE",
  "threat_cause_vector": "UNKNOWN",
  "threat_cause_cause_event_id": "5daf0f344edb11ebb2828b41ebaf3867",
  "blocked_threat_category": "UNKNOWN",
  "not_blocked_threat_category": "NON_MALWARE",
  "kill_chain_status": ["DELIVER_EXPLOIT"],
  "run_state": "RAN",
  "policy_applied": "NOT_APPLIED"
}

CONTAINER_RUNTIME

{
    "type": "CONTAINER_RUNTIME",
    "id": "aff50e67-d2cd-54a0-c3e3-1c6958d0005e",
    "legacy_alert_id": "aff50e67-d2cd-54a0-c3e3-1c6958d0005e",
    "org_key": "ABCD1234",
    "create_time": "2022-01-31T15:02:10Z",
    "last_update_time": "2022-01-31T15:02:10Z",
    "first_event_time": "2022-01-31T14:59:12Z",
    "last_event_time": "2022-01-31T14:59:12Z",
    "threat_id": "20ade0039400d2baf87c6a868df74ff31c8613b0b5823bd85ce8350e8c18e3cb",
    "severity": 5,
    "category": "WARNING",
    "policy_id": "7cce137c-b9c5-4cf0-96c7-2be6514f7a40",
    "policy_name": "demo001",
    "target_value": "MEDIUM",
    "workflow": {
        "state": "OPEN",
        "remediation": "",
        "last_update_time": "2022-01-31T15:00:14Z",
        "comment": "",
        "changed_by": "Carbon Black"
    },
    "alert_url": "https://defense-eap01.conferdeploy.net/alerts?orgId=1234567",
    "reason": "Detected a connection to a public destination that isn't allowed for this scope",
    "run_state": "RAN",
    "cluster_name": "e2e:containers-e2e-85wt",
    "namespace": "cbcontainers-dataplane",
    "workload_kind": "Deployment",
    "workload_id": "cbcontainers-hardening-enforcer",
    "workload_name": "cbcontainers-hardening-enforcer",
    "replica_id": "cbcontainers-hardening-enforcer-557d87866-4j4j5",
    "connection_type": "EGRESS",
    "remote_is_private": false,
    "remote_ip": "52.23.6.129",
    "protocol": "PROTO_TCP",
    "port": 443,
    "ip_reputation": 48,
    "rule_id": "f8b1637a-dc0c-49bb-bc28-5b48f97e6d58",
    "rule_name": "Allowed public destinations"
}

DEVICE_CONTROL

{
    "type": "DEVICE_CONTROL",
    "id": "uds_c8eb7306af264a9ab677814b3af69720",
    "legacy_alert_id": "C8EB7306-AF26-4A9A-B677-814B3AF69720",
    "org_key": "6X3T6RYXJ",
    "create_time": "2020-11-17T22:05:13Z",
    "last_update_time": "2020-11-17T22:05:13Z",
    "first_event_time": "2020-11-17T22:02:16Z",
    "last_event_time": "2020-11-17T22:02:16Z",
    "threat_id": "60b43c178d148756368ddea72f731ce108ea54d2b29171bff509c619d2a7eb6c",
    "severity": 3,
    "category": "WARNING",
    "device_id": 7604419,
    "device_os": "WINDOWS",
    "device_os_version": "Windows 10 x64",
    "device_name": "DESKTOP-4O07JV2",
    "device_username": "jdoe",
    "policy_id": 6997287,
    "policy_name": "Standard",
    "target_value": "MEDIUM",
    "workflow": {
        "state": "OPEN",
        "remediation": "",
        "last_update_time": "2020-11-17T22:02:16Z",
        "comment": "",
        "changed_by": "Carbon Black"
    },
    "device_internal_ip": "172.17.2.130",
    "device_external_ip": "71.218.76.221",
    "alert_url": "https://defense-eap01.conferdeploy.net/alerts?orgId=1889976",
    "reason": "Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.",
    "reason_code": "6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC",
    "device_location": "UNKNOWN",
    "threat_cause_threat_category": "NON_MALWARE",
    "threat_cause_vector": "REMOVABLE_MEDIA",
    "threat_cause_cause_event_id": "FCEE2AF0-D832-4C9F-B988-F11B46028C9E",
    "sensor_action": "DENY",
    "run_state": "DID_NOT_RUN",
    "policy_applied": "APPLIED",
    "vendor_name": "SanDisk",
    "vendor_id": "0x0781",
    "product_name": "U3 Cruzer Micro",
    "product_id": "0x5406",
    "serial_number": "0875920EF7C2A304"
}

watchlist.hit

{
  "schema": 1,
  "create_time": "2021-12-10T19:28:27.384Z",
  "device_external_ip": "200.201.30.123",
  "device_id": 4467271,
  "device_internal_ip": "10.33.4.214",
  "device_name": "Carbonblack-win1",
  "device_os": "WINDOWS",
  "ioc_hit": "(((process_name:cmd.exe AND process_cmdline:\\/c) AND -childproc_name:facefoduninstaller.exe)) -enriched:true",
  "ioc_id": "565642-0",
  "org_key": "6X3T6RYXJ",
  "parent_cmdline": "\"C:\\Program Files\\Aella\\aella_conf_win_srv\\aella_conf_win_srv.exe\"",
  "parent_guid": "6X3T6RYXJ-00442a47-00001520-00000000-1d7d5d3419e653f",
  "parent_hash": ["6174da1a2dd7594456bbb3ae50ac5587", "2ad7d1a17ee2dd897a5a45515e5ae46f8b6b61d3f67c90c1fa0c7910f06d0515"],
  "parent_path": "c:\\program files\\aella\\aella_conf_win_srv\\aella_conf_win_srv.exe",
  "parent_pid": 5408,
  "parent_publisher": [{
    "name": "Stellar Cyber Inc",
    "state": "FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED"
  }],
  "parent_reputation": "REP_ADAPTIVE",
  "parent_username": "NT AUTHORITY\\SYSTEM",
  "process_cmdline": "C:\\WINDOWS\\system32\\cmd.exe /c \"sc queryex aella_conf\"",
  "process_guid": "6X3T6RYXJ-00442a47-00001574-00000000-1d7edfbdd2d4880",
  "process_hash": ["d0fce3afa6aa1d58ce9fa336cc2b675b", "4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22"],
  "process_path": "c:\\windows\\syswow64\\cmd.exe",
  "process_pid": 5492,
  "process_publisher": [{
    "name": "Microsoft Windows",
    "state": "FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED"
  }],
  "process_reputation": "REP_WHITE",
  "process_username": "NT AUTHORITY\\SYSTEM",
  "report_id": "CFnKBKLTv6hUkBGFobRdg-565642",
  "report_name": "Execution - Command-Line Interface (cmd.exe /c)",
  "report_tags": ["attack", "attackframework", "threathunting", "hunting", "windows", "execution", "t1059"],
  "severity": 1,
  "type": "watchlist.hit",
  "watchlists": [{
    "id": "P5f9AW29TGmTOvBW156Cig",
    "name": "ATT\u0026CK Framework"
  }]
}

View the Full Documentation

Last modified on February 27, 2023