### Disable Tamper Protection for Computers by IP Prefix Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Disables tamper protection for computers whose IP addresses start with a specified prefix and moves them to a designated policy. This example requires additional code to complete the request. ```Python import requests, json ``` -------------------------------- ### GET /bit9platform/v1/serverPerformance Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of serverPerformance objects matching specified criteria. ```APIDOC ## GET /bit9platform/v1/serverPerformance ### Description Returns serverPerformance objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/serverPerformance ### Parameters #### Query Parameters - **q** (List) - Optional - Query parts - **group** (String) - Optional - Group by field - **sort** (String) - Optional - Sort by fields - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return. Omit to get only count of results. - **period** (Int32) - Optional - Period for statistics in hours. If omitted, it defaults to 24. ``` -------------------------------- ### Complex Search Filter Request Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Example of a GET request using multiple query conditions, operators, and escape sequences. ```HTTP [GET] https://myServer/api/bit9platform/v1/Computer?q=ipAddress:fe00*|ff00*&q=computerTag!&q=dateCreated>-10h&q=policyName:* ** ``` -------------------------------- ### GET /bit9platform/v1/fileRule Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves file rules matching given criteria. ```APIDOC ## GET /bit9platform/v1/fileRule ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/fileRule ``` -------------------------------- ### GET /bit9platform/v1/policy Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves policy objects that match given criteria. ```APIDOC ## GET /bit9platform/v1/policy ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/policy ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return. When 0 or not present, all results will be returned. When -1, only count will be returned. ``` -------------------------------- ### GET /bit9platform/v1/connector Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of connectors matching specified query criteria. ```APIDOC ## GET /bit9platform/v1/connector ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/connector ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return ``` -------------------------------- ### GET /bit9platform/v1/serverPerformance/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific serverPerformance object by its ID. ```APIDOC ## GET /bit9platform/v1/serverPerformance/{id} ### Description Returns a specific serverPerformance object based on the provided ID. ### Method GET ### Endpoint bit9platform/v1/serverPerformance/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested policy #### Query Parameters - **period** (Int32) - Optional - Period for statistics in hours. If omitted, it defaults to 24. ``` -------------------------------- ### GET /bit9platform/v1/computer/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific computer object instance. Requires 'View computers' permission. ```APIDOC ## GET /bit9platform/v1/computer/{id} ### Description Returns object instance of this class. ### Method GET ### Endpoint bit9platform/v1/computer/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ``` -------------------------------- ### GET /bit9platform/v1/fileRule/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific file rule by ID. ```APIDOC ## GET /bit9platform/v1/fileRule/{id} ### Description Returns object instance of this class. ### Method GET ### Endpoint bit9platform/v1/fileRule/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ``` -------------------------------- ### GET bit9platform/v1/fileInstance/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific file instance object by its unique identifier. ```APIDOC ## GET bit9platform/v1/fileInstance/{id} ### Description Returns a specific object instance of the fileInstance class. ### Method GET ### Endpoint bit9platform/v1/fileInstance/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - The unique identifier of the requested fileInstance object. ``` -------------------------------- ### GET bit9platform/v1/fileInstance Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Queries file instances based on provided criteria, supporting filtering, sorting, and pagination. ```APIDOC ## GET bit9platform/v1/fileInstance ### Description Returns a list of fileInstance objects that match the provided query criteria. ### Method GET ### Endpoint bit9platform/v1/fileInstance ### Parameters #### Query Parameters - **q** (List) - Optional - Query conditions (multiple supported). - **group** (String) - Optional - Field name to group results by. - **sort** (String) - Optional - Field name to sort results by. - **offset** (Int32) - Optional - Offset in query results. - **limit** (Int32) - Optional - Maximum number of results to return. 0 or not present returns all; -1 returns only the count. ``` -------------------------------- ### GET /bit9platform/v1/computer Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of computer objects matching given criteria. Requires 'View computers' permission. ```APIDOC ## GET /bit9platform/v1/computer ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/computer ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported). - **group** (String) - Optional - Field name to group by. - **sort** (String) - Optional - Field name to sort by. - **offset** (Int32) - Optional - Offset in query results. - **limit** (Int32) - Optional - Maximum number of results to return. ``` -------------------------------- ### GET /bit9platform/v1/fileRule Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of file rules based on specified query conditions and pagination settings. ```APIDOC ## GET /bit9platform/v1/fileRule ### Description Retrieves file rules from the platform. Supports multiple query conditions, grouping, sorting, and pagination. ### Method GET ### Endpoint /bit9platform/v1/fileRule ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return. When 0 or not present, all results will be returned. When -1, only count will be returned. ``` -------------------------------- ### GET /bit9platform/v1/connector/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific connector instance by its ID. ```APIDOC ## GET /bit9platform/v1/connector/{id} ### Description Returns the object instance of a specific connector. ### Method GET ### Endpoint bit9platform/v1/connector/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ``` -------------------------------- ### GET /bit9platform/v1/event/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific event instance by its unique identifier. ```APIDOC ## GET /bit9platform/v1/event/{id} ### Description Returns a single object instance of the event class. ### Method GET ### Endpoint bit9platform/v1/event/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ### Response #### Success Response (200) - **id** (Int64) - Unique event Id - **timestamp** (DateTime) - Date/Time when event was created (UTC) - **receivedTimestamp** (DateTime) - Date/Time when event was received by the server (UTC) - **description** (String) - Event description - **type** (Int32) - Event type - **subtype** (Int32) - Event subtype - **subtypeName** (String) - Event subtype as string - **ipAddress** (String) - IP address associated with this event - **computerId** (Int32) - Id of computer associated with this event - **computerName** (String) - Name of computer associated with this event - **policyId** (Int32) - Id of policy where agent was at the time of the event - **policyName** (String) - Name of policy where agent was at the time of the event - **fileCatalogId** (Int32) - Id of fileCatalog entry associated with file for this event - **installerFileCatalogId** (Int32) - Id of fileCatalog entry associated with installer for this event - **processFileCatalogId** (Int32) - Id of fileCatalog entry associated with process for this event - **fileName** (String) - Name of the file associated with this event - **pathName** (String) - Path of the file associated with this event - **commandLine** (String) - Full command line associated with this event - **processPathName** (String) - Name of the process associated with this event - **processFileName** (String) - Path of the process associated with this event - **installerFileName** (String) - Name of the installer associated with this event - **processKey** (String) - Process key associated with this event - **severity** (Int32) - Event severity - **userName** (String) - User name associated with this event - **ruleName** (String) - Rule name associated with this event - **banName** (String) - Ban name associated with this event - **updaterName** (String) - Updater name associated with this event - **indicatorName** (String) - Advanced threat indicator name associated with this event - **param1** (String) - Internal string parameter 1 - **param2** (String) - Internal string parameter 2 - **param3** (String) - Internal string parameter 3 - **stringId** (Int32) - Internal string Id used for description ``` -------------------------------- ### GET /bit9platform/v1/certificate Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of certificate objects matching specified query criteria. ```APIDOC ## GET /bit9platform/v1/certificate ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/certificate ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return ``` -------------------------------- ### GET /bit9platform/v1/event Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of events matching specified query criteria. ```APIDOC ## GET /bit9platform/v1/event ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/event ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return. When 0 or not present, all results will be returned. When -1, only count will be returned. ``` -------------------------------- ### GET /bit9platform/v1/certificate/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific certificate object instance by its ID. ```APIDOC ## GET /bit9platform/v1/certificate/{id} ### Description Returns a specific certificate object instance. ### Method GET ### Endpoint bit9platform/v1/certificate/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - The unique ID of the requested certificate. ``` -------------------------------- ### GET /serverConfig/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific server configuration object by its unique ID. This endpoint is read-only and requires 'View system configuration' permissions. ```APIDOC ## GET /serverConfig/{id} ### Description Returns a specific instance of the serverConfig object based on its ID. ### Method GET ### Endpoint `bit9platform/v1/serverConfig/{id}` ### Parameters #### Path Parameters - **id** (Int64) - Required - The unique identifier of the serverConfig object to retrieve. ### Response #### Success Response (200) - **id** (Int32) - Unique id of this serverConfig. - **name** (String) - Name of the property. - **value** (String) - Value of the property. - **dateModified** (DateTime) - Date/time when this property was last modified (UTC). - **modifiedBy** (String) - User that last modified this property. #### Response Example ```json { "id": 1, "name": "API_Version", "value": "2.1.0", "dateModified": "2023-10-27T10:00:00Z", "modifiedBy": "admin" } ``` ``` -------------------------------- ### GET /api/bit9platform/v1/computer Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of computers based on specified search criteria, sorting, and pagination parameters. ```APIDOC ## GET /api/bit9platform/v1/computer ### Description Retrieves computer objects from the App Control platform based on query conditions. ### Method GET ### Endpoint https:///api/bit9platform/v1/computer ### Parameters #### Query Parameters - **q** (string) - Optional - Query condition for filtering results. - **group** (string) - Optional - Grouping term for the results. - **sort** (string) - Optional - Field to sort the results by. - **offset** (integer) - Optional - Number of records to skip for pagination. - **limit** (integer) - Optional - Maximum number of records to return. ### Response #### Success Response (200) - **content** (array) - List of computer objects matching the query. #### Response Example { "content": [ { "id": 123, "name": "workstation-01" } ] } ``` -------------------------------- ### GET /bit9platform/v1/fileInstanceGroup Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Endpoints for retrieving file instance groupings from App Control Agents. ```APIDOC ## GET /bit9platform/v1/fileInstanceGroup/{id} ### Description Returns a specific instance of a file group record by its ID. ### Method GET ### Endpoint bit9platform/v1/fileInstanceGroup/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ## GET /bit9platform/v1/fileInstanceGroup ### Description Returns a list of file instance group objects that match the provided query criteria. ### Method GET ### Endpoint bit9platform/v1/fileInstanceGroup ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return ``` -------------------------------- ### Group Results by Field Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Request and response example for grouping results by a specific field, such as osShortName. ```HTTP [GET] https://myServer/api/bit9platform/v1/Computer?group=osShortName ``` ```JSON [ {"value": "CentOS 5", "count": 53}, {"value": "CentOS 6", "count": 826}, {"value": "Mac", "count": 2311}, {"value": "Windows 7", "count": 1330} ] ``` -------------------------------- ### GET /bit9platform/v1/meteredExecution Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of metered execution objects that match specified query criteria. ```APIDOC ## GET /bit9platform/v1/meteredExecution ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/meteredExecution?q={q1}&q={q2}...&group={group}&sort={sort}&offset={offset}&limit={limit} ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return. 0 or not present returns all; -1 returns only count. ``` -------------------------------- ### GET /bit9platform/v1/meteredExecution/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific metered execution instance by its unique identifier. ```APIDOC ## GET /bit9platform/v1/meteredExecution/{id} ### Description Returns a specific object instance of the meteredExecution class. ### Method GET ### Endpoint bit9platform/v1/meteredExecution/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - The unique identifier of the requested object. ### Response #### Success Response (200) - **id** (Int32) - Unique id of this meteredExecution - **meterId** (Int32) - Id of meter associated with this execution - **name** (String) - Name of meter associated with this execution - **description** (String) - Description of meter associated with this execution - **type** (Int32) - How the meter was defined (1=md5, 2=sha1, 4=file name, 5=sha-256, 6=fuzzy sha-256) - **data** (String) - Data from definition of meter - **eventId** (Int64) - Id of event associated with this execution - **computerId** (Int32) - Id of computer associated with this execution - **fileCatalogId** (Int32) - Id of filecatalog entry associated with this execution - **timestamp** (DateTime) - Date/time associated with this execution (UTC) - **userName** (String) - User name associated with this execution ``` -------------------------------- ### Retrieve Result Count Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Request and response example for retrieving only the total count of results by setting the limit parameter to -1. ```HTTP [GET] https://myServer/api/bit9platform/computer?limit=-1 ``` ```JSON {"count": 1284} ``` -------------------------------- ### GET /publisher Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of publishers matching the specified criteria. This operation requires 'View software rules pages' permission. ```APIDOC ## GET /publisher ### Description Returns objects that match given criteria. ### Method GET ### Endpoint `bit9platform/v1/publisher` ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple query conditions are supported). - **group** (String) - Optional - Field name to group by. - **sort** (String) - Optional - Field name to sort by. - **offset** (Int32) - Optional - Offset in query results. - **limit** (Int32) - Optional - Maximum number of results to return. When 0 or not present, all results will be returned. When -1, only count will be returned. ### Response #### Success Response (200) - **id** (Int32) - Unique id of this publisher - **name** (String) - Subject name of leaf certificate for this publisher - **description** (String) - User-defined description for this publisher - **modifiedBy** (String) - User that last modified this publisher - **dateCreated** (DateTime) - Date/time when this publisher was first seen (UTC) - **dateModified** (DateTime) - Date/time when this publisher was last modified (UTC) - **publisherReputation** (Int32) - Reputation of this publisher (0=Not trusted, 1=Low, 2=Medium, 3=High) - **publisherState** (Int32) - State for this publisher (1=Unapproved, 2=Approved, 3=Banned) - **policyIds** (String) - List of IDs of policies where this rule applies. Empty if this is a global rule - **reputationApprovalsEnabled** (Boolean) - True if publisher can be approved by reputation - **sourceType** (Int32) - Mechanism that changed publisher state (1 = Manual, 3 = Reputation, 5 = External (API)) - **firstSeenComputerId** (Int32) - Id of `computer` where this publisher was first seen - **platformFlags** (Int32) - Set of platform flags where this publisher will be approved/banned (1 = Windows, 2 = Mac, 4 = Linux) - **signedFilesCount** (Int32) - Number of files this publisher has signed - **signedCertificateCount** (Int32) - Number of certificates associated with this publisher - **hidden** (Boolean) - True if publisher is hidden from the UI - **clVersion** (Int64) - CL version associated with this publisher #### Response Example ```json [ { "id": 123, "name": "Example Publisher 1", "description": "Description 1", "modifiedBy": "admin", "dateCreated": "2023-10-27T10:00:00Z", "dateModified": "2023-10-27T10:30:00Z", "publisherReputation": 3, "publisherState": 2, "policyIds": "10", "reputationApprovalsEnabled": true, "sourceType": 5, "firstSeenComputerId": 456, "platformFlags": 1, "signedFilesCount": 100, "signedCertificateCount": 5, "hidden": false, "clVersion": 1000 }, { "id": 124, "name": "Example Publisher 2", "description": "Description 2", "modifiedBy": "user", "dateCreated": "2023-10-26T09:00:00Z", "dateModified": "2023-10-26T09:15:00Z", "publisherReputation": 2, "publisherState": 1, "policyIds": "", "reputationApprovalsEnabled": false, "sourceType": 1, "firstSeenComputerId": 457, "platformFlags": 3, "signedFilesCount": 50, "signedCertificateCount": 2, "hidden": true, "clVersion": 950 } ] ``` ``` -------------------------------- ### POST bit9platform/v1/fileInstance Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Creates or changes the local state of a file instance. ```APIDOC ## POST bit9platform/v1/fileInstance ### Description Change the local state of a file instance. Requires 'View files' and 'Change local state' permissions. ### Method POST ### Endpoint bit9platform/v1/fileInstance ### Parameters #### Request Body - **value** (fileInstance) - Required - The new fileInstance object containing the updated state. ``` -------------------------------- ### GET /v1/pendingAnalysis/{id} (Get specific pending analysis object) Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific pending analysis request object by its ID. ```APIDOC ## GET /v1/pendingAnalysis/{id} ### Description Returns object instance of this class. ### Method GET ### Endpoint `/v1/pendingAnalysis/{id}` ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ### Response #### Success Response (200) - **id** (Int64) - Unique fileAnalysis id - **priority** (Int64) - Priority of this file analysis - **uploaded** (Boolean) - True if file is available - **fileCatalogId** (Int32) - Id of `fileCatalog` entry associated with this analysis - **connectorId** (Int32) - Id of `connector` associated with this analysis - **createdBy** (String) - User that requested this analysis - **dateCreated** (DateTime) - Date/Time when fileAnalysis request was created (UTC) - **dateModified** (DateTime) - Date/Time when fileAnalysis request was last modified (UTC) - **fileName** (String) - Name of the file where file exists on the endpoint - **pathName** (String) - Path of the file where file exists on the endpoint - **md5** (String) - Md5 hash of file to be analyzed (if available) - **sha1** (String) - Sha-1 hash of file to be analyzed (if available) - **sha256** (String) - Sha-256 hash of file to be analyzed - **uploadPath** (String) - Local upload path for this file on the server (can be a shared network path). Note that file is compressed in a ZIP archive - **uploadedFileSize** (Int64) - Size of uploaded file. This will be 0 if analysisStatus is 0 (Scheduled) - **analysisStatus** (Int32) - Status of analysis. Can be one of: 0 = scheduled, 1 = submitted, 2 = processed, 3 = analyzed, 4 = error, 5 = cancelled - **analysisResult** (Int32) - Result of the analysis. Can be one of: 0 = Not yet available, 1 = File is clean, 2 = File is a potential threat, 3 = File is malicious - **analysisTarget** (String) - Target of the analysis (Connector-dependent) - **analysisError** (String) - Error that occurred during analysis #### Response Example { "example": "[Pending analysis object]" } ``` -------------------------------- ### GET /v1/pendingAnalysis/{id} (Get pending analysis by ID with optional file download) Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific pending analysis request by its ID. Optionally, you can download the analyzed file if it's available. ```APIDOC ## GET /v1/pendingAnalysis/{id} ### Description Returns pending analysis requests for a given id. ### Method GET ### Endpoint `/v1/pendingAnalysis/{id}` ### Parameters #### Path Parameters - **id** (Int64) - Required - Pending analysis id #### Query Parameters - **downloadFile** (Boolean) - Optional - Set to true to get binary file back in the response of the message (valid only if uploaded is true). Can return 503 in case when server is overloaded. In that case try again later. ### Response #### Success Response (200) - **id** (Int64) - Unique fileAnalysis id - **priority** (Int64) - Priority of this file analysis - **uploaded** (Boolean) - True if file is available - **fileCatalogId** (Int32) - Id of `fileCatalog` entry associated with this analysis - **connectorId** (Int32) - Id of `connector` associated with this analysis - **createdBy** (String) - User that requested this analysis - **dateCreated** (DateTime) - Date/Time when fileAnalysis request was created (UTC) - **dateModified** (DateTime) - Date/Time when fileAnalysis request was last modified (UTC) - **fileName** (String) - Name of the file where file exists on the endpoint - **pathName** (String) - Path of the file where file exists on the endpoint - **md5** (String) - Md5 hash of file to be analyzed (if available) - **sha1** (String) - Sha-1 hash of file to be analyzed (if available) - **sha256** (String) - Sha-256 hash of file to be analyzed - **uploadPath** (String) - Local upload path for this file on the server (can be a shared network path). Note that file is compressed in a ZIP archive - **uploadedFileSize** (Int64) - Size of uploaded file. This will be 0 if analysisStatus is 0 (Scheduled) - **analysisStatus** (Int32) - Status of analysis. Can be one of: 0 = scheduled, 1 = submitted, 2 = processed, 3 = analyzed, 4 = error, 5 = cancelled - **analysisResult** (Int32) - Result of the analysis. Can be one of: 0 = Not yet available, 1 = File is clean, 2 = File is a potential threat, 3 = File is malicious - **analysisTarget** (String) - Target of the analysis (Connector-dependent) - **analysisError** (String) - Error that occurred during analysis #### Response Example { "example": "[Pending analysis object or binary file content]" } ``` -------------------------------- ### GET /serverConfig Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves server configuration objects that match specified criteria. Supports filtering, grouping, sorting, and pagination. This endpoint is read-only and requires 'View system configuration' permissions. ```APIDOC ## GET /serverConfig ### Description Returns objects that match the given criteria. Supports filtering with multiple query conditions, grouping, sorting, and pagination. ### Method GET ### Endpoint `bit9platform/v1/serverConfig?q={q1}&q={q2}...&group={group}&sort={sort}&offset={offset}&limit={limit}` ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition. Multiple query conditions are supported. - **group** (String) - Optional - Field name to group the results by. - **sort** (String) - Optional - Field name to sort the results by. - **offset** (Int32) - Optional - Offset in the query results. Defaults to 0. - **limit** (Int32) - Optional - Maximum number of results to return. If 0 or not present, all results are returned. If -1, only the count is returned. ### Response #### Success Response (200) - **id** (Int32) - Unique id of this serverConfig. - **name** (String) - Name of the property. - **value** (String) - Value of the property. - **dateModified** (DateTime) - Date/time when this property was last modified (UTC). - **modifiedBy** (String) - User that last modified this property. #### Response Example ```json [ { "id": 1, "name": "API_Version", "value": "2.1.0", "dateModified": "2023-10-27T10:00:00Z", "modifiedBy": "admin" }, { "id": 2, "name": "ParityServerVersion", "value": "7.2.0", "dateModified": "2023-10-27T09:30:00Z", "modifiedBy": "system" } ] ``` ``` -------------------------------- ### PUT bit9platform/v1/fileInstance/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Updates the local state of an existing file instance. ```APIDOC ## PUT bit9platform/v1/fileInstance/{id} ### Description Change the local state of a specific file instance. Requires 'View files' and 'Change local state' permissions. ### Method PUT ### Endpoint bit9platform/v1/fileInstance/{id} ### Parameters #### Path Parameters - **id** (Int32) - Required - The ID of the fileInstance to update. #### Request Body - **value** (fileInstance) - Required - The new fileInstance object containing the updated state. ``` -------------------------------- ### PUT /bit9platform/v1/computer/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Updates a specific computer object. Requires 'View computers' and 'Manage computers' permissions. ```APIDOC ## PUT /bit9platform/v1/computer/{id} ### Description Updates a computer object. Note that some computer properties can be changed only if specific boolean parameters are set. ### Method PUT ### Endpoint bit9platform/v1/computer/{id} ### Parameters #### Path Parameters - **id** (Int32) - Required - Id of computer to change. #### Query Parameters - **changeDiagnostics** (Boolean) - Optional - If true, debug and CC properties are updated. Requires 'Change advanced options' permission. - **changeTemplate** (Boolean) - Optional - If true, template settings are updated. Requires 'Change advanced options' permission. - **delete** (Boolean) - Optional - Deletes computer entry. - **resetCLIPassword** (Boolean) - Optional - Resets CLI password. Requires 'Change advanced options' permission. - **newTamperProtectionActive** (Nullable) - Optional - Sets desired tamper protection. Requires 'Change advanced options' permission. #### Request Body - **value** (computer) - Required - Updated computer object. ``` -------------------------------- ### POST /bit9platform/v1/fileRule Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Creates or updates a file rule. ```APIDOC ## POST /bit9platform/v1/fileRule ### Description Creates or updates a file rule. ### Method POST ### Endpoint bit9platform/v1/fileRule ### Parameters #### Request Body - **value** (fileRule) - Required - New file rule object ``` -------------------------------- ### GET /fileUpload/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific file upload object by its ID. ```APIDOC ## GET /fileUpload/{id} ### Description Retrieves a specific file upload object by its ID. ### Method GET ### Endpoint `/bit9platform/v1/fileUpload/{id}` ### Parameters #### Path Parameters - **id** (Int64) - Required - The unique identifier of the file upload object. #### Query Parameters - **downloadFile** (Boolean) - Optional - Set to `true` to retrieve the binary file content if the upload status is 'Completed'. Note: This may return a 503 error if the server is overloaded; retrying later is recommended. ### Response #### Success Response (200) - **id** (Int32) - Unique ID of this fileUpload. - **computerId** (Int32) - ID of the computer entry associated with this analysis. - **fileCatalogId** (Int32) - ID of the fileCatalog entry associated with this upload. - **createdBy** (String) - User that requested the upload. - **dateCreated** (DateTime) - Date and time when the upload was requested (UTC). - **dateModified** (DateTime) - Date and time when the upload was last modified by the system (UTC). - **fileName** (String) - Name of the file on the endpoint. - **pathName** (String) - Path of the file on the endpoint. - **priority** (Int32) - Upload priority in the range of [-2, 2], where 2 is the highest priority. Defaults to 0. - **uploadPath** (String) - Local upload path for this file on the server (can be a shared network path). The file is compressed in a ZIP archive. - **uploadedFileSize** (Int64) - Size of the uploaded file. This will be 0 unless `uploadStatus` is 3 (Completed). - **uploadStatus** (Int32) - Status of the upload. Possible values: 0 = Queued, 1 = Initiated, 2 = Uploading, 3 = Completed, 4 = Error, 5 = Cancelled, 6 = Deleted. #### Response Example ```json { "id": 123, "computerId": 456, "fileCatalogId": 789, "createdBy": "admin", "dateCreated": "2023-10-27T10:00:00Z", "dateModified": "2023-10-27T10:05:00Z", "fileName": "example.exe", "pathName": "C:\\Users\\Admin\\Documents", "priority": 0, "uploadPath": "\\\\server\\\\uploads", "uploadedFileSize": 102400, "uploadStatus": 3 } ``` ``` -------------------------------- ### POST /bit9platform/v1/certificate Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Creates or updates a certificate state. ```APIDOC ## POST /bit9platform/v1/certificate ### Description Change certificate state. ### Method POST ### Endpoint bit9platform/v1/certificate ### Parameters #### Request Body - **value** (certificate) - Required - Certificate object with desired parameters (description, certificateState) ``` -------------------------------- ### Group Events by 2-Month Time Windows Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Groups events by specified time windows. Use `groupType` for time units (s, m, h, d, w, n) and `groupStep` for the interval. Output includes `dateFrom`, `dateTo`, and `count` for each window. Empty windows are included. ```HTTP [GET] https://myServer/api/bit9platform/v1/event?group=timestamp&groupType=n&groupStep=2 ``` -------------------------------- ### GET /bit9platform/v1/updater Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of updater objects matching specified criteria. ```APIDOC ## GET /bit9platform/v1/updater ### Description Returns objects that match given criteria. ### Method GET ### Endpoint bit9platform/v1/updater?q={q1}&q={q2}...&group={group}&sort={sort}&offset={offset}&limit={limit} ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return ``` -------------------------------- ### GET /bit9platform/v1/policy/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific policy object instance by its ID. ```APIDOC ## GET /bit9platform/v1/policy/{id} ### Description Returns object instance of this class. ### Method GET ### Endpoint bit9platform/v1/policy/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ``` -------------------------------- ### GET /v1/fileAnalysis/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific file analysis request by its ID. ```APIDOC ## GET /v1/fileAnalysis/{id} ### Description Returns a specific file analysis request object by its ID. ### Method GET ### Endpoint `/v1/fileAnalysis/{id}` ### Parameters #### Path Parameters - **id** (Int64) - Required - ID of the file analysis object to retrieve. ### Response #### Success Response (200) - **id** (Int64) - Unique fileAnalysis id - **computerId** (Int32) - Id of computer entry associated with this analysis - **fileCatalogId** (Int32) - Id of fileCatalog entry associated with this analysis - **connectorId** (Int32) - Id of connector associated with this analysis - **createdBy** (String) - User that requested this analysis - **dateCreated** (DateTime) - Date/Time when fileAnalysis request was created (UTC) - **dateModified** (DateTime) - Date/Time when fileAnalysis request was last modified (UTC) - **fileName** (String) - Name of the file where file exists on the endpoint - **pathName** (String) - Path of the file where file exists on the endpoint - **priority** (Int32) - File analysis priority in range [-2, 2], where 2 is highest priority. Default priority is 0 - **analysisStatus** (Int32) - Status of analysis (0=scheduled, 1=submitted, 2=processed, 3=analyzed, 4=error, 5=cancelled) - **analysisResult** (Int32) - Result of the analysis (0=Not yet available, 1=File is clean, 2=File is a potential threat, 3=File is malicious) - **analysisTarget** (String) - Target of the analysis (Connector-dependent) #### Response Example ```json { "id": 1, "computerId": 123, "fileCatalogId": 456, "connectorId": 789, "createdBy": "admin", "dateCreated": "2023-10-27T10:00:00Z", "dateModified": "2023-10-27T10:05:00Z", "fileName": "example.exe", "pathName": "C:\\Users\\Admin\\Downloads", "priority": 1, "analysisStatus": 0, "analysisResult": 0, "analysisTarget": "example_target" } ``` ``` -------------------------------- ### GET /bit9platform/v1/updater/{id} Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a specific updater object instance by its ID. ```APIDOC ## GET /bit9platform/v1/updater/{id} ### Description Returns object instance of this class. ### Method GET ### Endpoint bit9platform/v1/updater/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ``` -------------------------------- ### GET /fileUpload Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Retrieves a list of file upload objects based on specified criteria. ```APIDOC ## GET /fileUpload ### Description Retrieves a list of file upload objects matching the given criteria. ### Method GET ### Endpoint `/bit9platform/v1/fileUpload` ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition. Multiple query conditions are supported. - **group** (String) - Optional - Field name to group the results by. - **sort** (String) - Optional - Field name to sort the results by. - **offset** (Int32) - Optional - The number of results to skip in the query. - **limit** (Int32) - Optional - The maximum number of results to return. If 0 or not present, all results are returned. If -1, only the count of results is returned. ### Response #### Success Response (200) Returns an array of file upload objects matching the query criteria. The structure of each object is the same as described in the 'GET /fileUpload/{id}' endpoint. #### Response Example ```json [ { "id": 123, "computerId": 456, "fileCatalogId": 789, "createdBy": "admin", "dateCreated": "2023-10-27T10:00:00Z", "dateModified": "2023-10-27T10:05:00Z", "fileName": "example.exe", "pathName": "C:\\Users\\Admin\\Documents", "priority": 0, "uploadPath": "\\\\server\\\\uploads", "uploadedFileSize": 102400, "uploadStatus": 3 }, { "id": 124, "computerId": 457, "fileCatalogId": 790, "createdBy": "user", "dateCreated": "2023-10-27T11:00:00Z", "dateModified": "2023-10-27T11:02:00Z", "fileName": "document.pdf", "pathName": "D:\\Docs", "priority": 1, "uploadPath": "\\\\server\\\\uploads", "uploadedFileSize": 0, "uploadStatus": 0 } ] ``` ``` -------------------------------- ### GET /bit9platform/v1/fileInstanceDeleted Source: https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api Endpoints for retrieving information about deleted files on App Control Agents. ```APIDOC ## GET /bit9platform/v1/fileInstanceDeleted/{id} ### Description Returns a specific instance of a deleted file record by its ID. ### Method GET ### Endpoint bit9platform/v1/fileInstanceDeleted/{id} ### Parameters #### Path Parameters - **id** (Int64) - Required - id of a requested object ## GET /bit9platform/v1/fileInstanceDeleted ### Description Returns a list of deleted file objects that match the provided query criteria. ### Method GET ### Endpoint bit9platform/v1/fileInstanceDeleted ### Parameters #### Query Parameters - **q** (List) - Optional - Query condition (multiple supported) - **group** (String) - Optional - Field name to group by - **sort** (String) - Optional - Field name to sort by - **offset** (Int32) - Optional - Offset in query results - **limit** (Int32) - Optional - Maximum number of results to return ```