Carbon Black EDR (Endpoint Detection and Response) is the new name for the product formerly called CB Response.
First lets import all the modules necessary to use the Live Response functionality within CbAPI
from cbapi.response import CbEnterpriseResponseAPI from cbapi.response.models import Sensor
Now create an EDR API object.
c = CbEnterpriseResponseAPI()
Using python’s with statement, we can create a live response session. Anything within this block can use the Live Response Session object and the session will be kept alive automatically.
with c.select(Sensor, 1).lr_session() as lr_session:
lr_session.delete_file('C:\test.txt') lr_session.put_file('this is the file content', r"C:\test.txt") lr_session.get_file(r"C:\test.txt")