This repository has been archived by the owner. It is now read-only.
Carbonblack Live Response from the comfort of your own terminal
Switch branches/tags
Nothing to show
Clone or download
Latest commit 8f69d8f Jan 20, 2016

alt tag

CBLR (Carbonblack Live Response) Console

Utilizes the Carbon Black Sensor API

Introduced in v5.0

The Carbon Black Live Response Sensor API allows incident responders to automate investigation and triage activities on any Windows endpoint with the v5.0+ sensor installed. The API includes a number of built-in functions, including bidirectional file transfer and process execution. Upload yara and search for signatures or upload your own Powershell scripts to run scripted actions locally. It does not matter where the sensor is currently located - inside the corporate LAN or at Starbucks, if the sensor is pushing data to the Carbon Black server, the Sensor API can be used for investigations.


The Carbon Black API is versioned. A new API revision is released in lockstep with each release of the Carbon Black Enterprise Server.

Previous version documentation can be found using git tags.