Carbon Black Cloud: How to export Admin Users via Postman

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Audit and Remediation (CB LiveOps)
  • Enterprise EDR (CB ThreatHunter)
  • Managed Detection (CB ThreatSight)
  • Endpoint Standard (CB Defense)
  • Endpoint Advanced (CB Defense + CB LiveOps)
  • Endpoint Enterprise (CB Defense + CB LiveOps + CB ThreatHunter)
• Machine able to run Postman

Objective

Provide steps to export the list of Administrators from Settings > Users

Resolution

1. Create API Key

1. Log into Console
2. Go to Settings > API Keys
3. Copy Org ID
4. Click 'Add API Key' button
5. 'Add API Key' modal/pop-up appears
6. Enter name for easy identification

   Example: General_Export_From_Console

7. Set Access Level

   Access level: Custom
   Custom access level: View All
   
   *Warning message can be ignored:
   This permission set may contain unversioned APIs. Visit developer.carbonblack.com for all currently supported/versioned APIs.

8. Enter Description as desired
9. Click 'Save'
10. Copy API credentials displayed ({{api_id}}, {{secret_key}} below)

2. Configure Postman

1. Download and install Postman
2. Download configuration JSON file and import into Postman
3. Define variables and name the Environment for use with API calls

   {{api_id}}
   {{environment}}
   {{org_id}}
   {{secret_key}}

4. Select the Environment created
5. View Collection named 'Export All Admin Users'
6. Run the 'Export All Admin Users' call
7. Click 'Save Response' > 'Save to a file' and name the file (Ex: Export_All_Admin_Users.json)

Additional Notes

• The Role (adminRole) will be displayed as DEPRECATED, as mapping from Users to Roles is done on the backend
• For ease of use, there are a number of options available online to convert JSON files to CSV using Python, Java, etc.

Related Content

GitHub: JSON to CSV
Carbon Black Cloud: Where is the Org Key Found?
Carbon Black Cloud: Where is the Org ID Found?
Configuring Postman for Admin Users data export
Carbon Black Cloud: How to export Admin Users via cURL