carbon-black-cloud
Installation
SKILL.md
Carbon Black Cloud Enterprise EDR — content authoring
This skill encodes operational context for authoring detection content in configurations.carbon_black_cloud blocks of OpenTide MDR objects. Carbon Black Cloud (CBC) Enterprise EDR (formerly CB ThreatHunter) is the relevant product surface; older CB Response (on-prem) is not the same product.
1. Surface identification
| Surface | Used for |
|---|---|
| Process Search (Investigate) | Ad-hoc hunting via the search bar / API |
| Watchlists | Recurring alert generation backed by Reports / IOCs |
| Scheduled Searches (via API) | Custom periodic queries with action hooks |
| Alerts | Notable events from Watchlist hits, sensor IOC matches, NGAV detections |
| Live Response | Constrained shell over the sensor for IR |
| Threat Intel Feeds | Subscribed third-party / Carbon Black-curated indicator streams |
CBC's primary detection authoring surface is Watchlists (curated collections of Reports, each containing one or more IOCs/queries). Scheduled searches are a complementary mechanism for query-based detections that need richer aggregation.