How to Export Carbon Black Logs

For a targeted pull from Carbon Black Cloud, use the Platform Search API. Create a process search job, wait until all backends have answered, and fetch the results as JSON. For bulk, continuous export, set up the Data Forwarder, which writes endpoint events, alerts and watchlist hits to your own S3 bucket as compressed JSON. Carbon Black EDR, the on-premises product formerly called Response, has a different API.

Carbon Black, now part of Broadcom, records process activity on a lot of corporate endpoints. Prime Core has 15,590 detection rules for Carbon Black, mapped to 638 MITRE ATT&CK techniques. Below is how to get the data out, sanitize it, and investigate it for free in LogTotal.

Get Started For Free

Before you start

An API key and your org key. Create an API key whose access level allows process search, and note the API ID and secret. The org key is shown in the console’s API access settings. Together they make the header X-Auth-Token: <secret>/<id>.

Your environment’s host. Carbon Black Cloud runs several environments, each with its own hostname (for example defense.conferdeploy.net or defense-eu.conferdeploy.net). Use the one in your console URL.

Retention. Process data is kept for a limited time, depending on your subscription. The Data Forwarder is how you keep more.

Option 1: Process search API

CBC="https://defense.conferdeploy.net"
ORG="<org_key>"
H="X-Auth-Token: $CB_API_SECRET/$CB_API_ID"

# 1. start the search job
JOB=$(curl -sS -X POST "$CBC/api/investigate/v2/orgs/$ORG/processes/search_jobs" \
  -H "$H" -H 'Content-Type: application/json' \
  -d '{"query": "device_name:ws-042", "time_range": {"start": "2026-10-19T00:00:00Z", "end": "2026-10-20T00:00:00Z"}, "fields": ["*"], "rows": 10000}' \
  | jq -r '.job_id')

# 2. wait until every backend has answered
until curl -sS -H "$H" "$CBC/api/investigate/v2/orgs/$ORG/processes/search_jobs/$JOB/results?rows=0" \
      | jq -e '.contacted == .completed' >/dev/null; do sleep 3; done

# 3. fetch the results
curl -sS -H "$H" "$CBC/api/investigate/v2/orgs/$ORG/processes/search_jobs/$JOB/results?start=0&rows=10000" \
  | jq -c '.results[]' > cb_ws042_1019.jsonl

This returns process records. Network connections, file and registry modifications for a process are available through the process event details APIs. The official Python SDK (carbon-black-cloud-sdk) wraps all of this.

Option 2: Data Forwarder (bulk)

In the console, configure a Data Forwarder to an S3 bucket you own and choose the data types: endpoint events, alerts, watchlist hits. Files arrive as compressed JSON, one record per line. For an investigation, download the time range and filter by device:

aws s3 cp s3://my-cb-forwarder/<prefix>/ ./cb-fwd/ --recursive
zcat ./cb-fwd/**/*.gz | jq -c 'select(.device_name == "ws-042")' > cb_fwd_ws042.jsonl

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file.
2. Sanitize.
3. Review.

When it goes wrong