CB ThreatHunter API¶
This page documents the public interfaces exposed by cbapi when communicating with a Carbon Black PSC ThreatHunter server.
Main Interface¶
To use cbapi with Carbon Black ThreatHunter, you use CbThreatHunterAPI objects.
These objects expose two main methods to access data on the
ThreatHunter server: select
and create
.
Queries¶
The ThreatHunter API uses QueryBuilder instances to construct structured
or unstructured (i.e., raw string) queries. You can either construct these
instances manually, or allow CbThreatHunterAPI.select()
to do it for you: