Environment
- Carbon Black Cloud Console: 0.38 Release and higher
- Carbon Black Cloud Linux Sensor: 2.3.x.x and Higher
- Carbon Black Cloud macOS Sensor: 3.3.x.x and Higher
- Carbon Black Cloud Windows Sensor: 3.3.x.x and Higher
Question
What is Live Query?
Answer
Live Query is part of the Audit and Remediation (was CB LiveOps) offering for Carbon Black Cloud. Live Query is based on Osquery, which exposes an operating system as a high-performance relational database that can be queried for operating system data. Live Query allows the administrator to query current state/config/properties of one or more endpoints.
Additional Notes
- Live Query uses SQL syntax to query for data, which is executed on the endpoint and returned to the backend and displayed on the Query Results page
- Live Query results can be exported from the Console UI as a CSV file
- Live Query results can be exported using the Audit & Remediation APIs in either JSON (default) or CSV formats
Related Content
