The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

All Listening Ports by Process

Description: List ports that are listening on all interfaces, along with the process to which they are attached.

What The Data Shows: Useful for auditing attack surface, IT Hygiene, or vulnerable software.

SQL:

 

SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline
FROM listening_ports lp
JOIN processes p ON lp.pid = p.pid
WHERE lp.address = "0.0.0.0";
2 Comments
esullivan
Carbon Black Employee

hey @cfogleman thank you for your submission!  We will test your query and if it runs as expected we'll update your submission from Under Review to CB Approved.

Thanks again!

Ed

jnelson
Carbon Black Employee
Status changed to: Approved