Carbon Black Cloud: How to export Admin Users via cURL

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Audit and Remediation (CB LiveOps)
  • Enterprise EDR (CB ThreatHunter)
  • Managed Detection (CB ThreatSight)
  • Endpoint Standard (CB Defense)
  • Endpoint Advanced (CB Defense + CB LiveOps)
  • Endpoint Enterprise (CB Defense + CB LiveOps + CB ThreatHunter)
• Machine able to run cURL commands

Objective

To export the list of Administrators from Settings > Users via cURL as a workaround to not having an Export button/link built into the Console on the Users page

Resolution

1. Create API Key

1. Log into Console
2. Go to Settings > API Keys
3. Copy Org ID (top-left, <OrgID> below)
4. Click 'Add API Key' button
5. 'Add API Key' modal/pop-up appears
6. Enter name for easy identification

   Example: General_Export_From_Console

7. Set Access Level

   Access level: Custom
   Custom access level: View All
   
   *Warning message can be ignored:
   This permission set may contain unversioned APIs. Visit developer.carbonblack.com for all currently supported/versioned APIs.

8. Enter Description as desired
9. Click 'Save'
10. Copy API credentials displayed (<API_ID>, <API_Secret_Key> below)

2. Export Admin Users

1. Log into machine able to run cURL
2. Run API call to export the data

   curl -H X-Auth-Token:<API_Secret_Key>/<API_ID> https://<Dashboard_URL>/appservices/v5/orgs/<ORG_ID>/users

3. Save data to file as desired

Additional Notes

• The API above (.../appservices/v5/orgs/<ORG_ID>/users) is an unofficial and unsupported API which is used to populate information for the Console UI and is not supported for use as a standalone API
• Being an unsupported API means the specified route/endpoint could be changed at any point and without notice
• The Role (adminRole) will be displayed as DEPRECATED, as the API has not been updated to work with newer Admin Roles (Level 1/2/3 Analyst, Super Admin, and others)
• For ease of use, there are a number of options available online to convert JSON files to CSV using Python, Java, etc.

Related Content

GitHub: JSON to CSV
Carbon Black Cloud: How to Export Roles via cURL
Carbon Black Cloud: What URLs are used to access the APIs?
Carbon Black Cloud: Where is the Org Key Found?
PSC: Where is the Org ID Found?
CB Cloud: How to export Admin Users via Postman