Live Query extension tables are available for Windows 3.8+ sensors. These tables provide insight into the Carbon Black Cloud Windows sensor.

Table 1. cb_sensor_canaries
Column Type Description Version
name TEXT Full path name of the canary file 3.9+
cloud_id INTEGER Identifier that the cloud provided config has assigned to the canary file 3.9+
hidden_file INTEGER Boolean value for if the file has the Hidden Attribute set 3.9+
hidden_destination_dir INTEGER Boolean value for if we created the destination directory with the Hidden Attribute 3.9+
system_file INTEGER Boolean value if the file has the System Attribute set 3.9+
system_destination_dir INTEGER Boolean value if we created the destination directory with the System Attribute 3.9+
same_name INTEGER Boolean value if the previous canary file at this location had the same name 3.9+
file_creation_time UNSIGNED_BIGINT Creation time of the file in milliseconds since Unix epoch 3.9+
fize_size UNSIGNED_BIGINT Size of the file in bytes 3.9+
Note: cb_sensor_canaries extensions return deployed canary file details for the Carbon Black Cloud Windows Sensor.
Table 2. cb_sensor_compliance_scan_results
Column Type Description Version
rule_guid TEXT The scan rule GUID 3.9+
policy_guid TEXT The policy GUID 3.9+
rule_description TEXT The scan rule description 3.9+
policy_description TEXT The policy description 3.9+
policy_revision TEXT The policy revision 3.9+
scan_result TEXT The compliance scan result, PASS, FAIL, UNKNOWN 3.9+
scan_settings TEXT The compliance scan settings ran on system 3.9+
Note: cb_sensor_compliance_scan_results extensions return the compliance scan results performed by Carbon Black Cloud Windows Sensor.
Table 3. cb_sensor_counters
Column Type Description Version
name TEXT Name of the counter 3.8+
value UNSIGNED_BIGINT (Relevant for Non-Duration Counters) Amount of times triggered 3.8+
total UNSIGNED_BIGINT (Duration Counters) Total Time in ms 3.8+
count UNSIGNED_BIGINT (Duration Counters) Number of times the counter was hit 3.8+
min UNSIGNED_BIGINT (Duration Counters) Minimum time spent for one passthrough in ms 3.8+
max UNSIGNED_BIGINT (Duration Counters) Maximum time spent for one passthrough in ms 3.8+
Note: cb_sensor_counters extensions return current counter details for the Carbon Black Cloud Windows sensor. Sensor counters track sensor actions that have occurred since the last sensor restart.
Table 4. cb_sensor_configprops
Column Type Description Version
name TEXT Name of the configprop 3.8+
value TEXT Value of the configprop 3.8+
is_kernel_configprop INTEGER 1: Kernel configprop; 0: Usermode configprop 3.8+
Note: cb_sensor_configprops extensions return current configprop details and assignments for the Carbon Black Cloud Windows sensor. Config props are a collection of sensor settings that are configured at the time of installation, based on console settings and installation parameters.
Table 5. cb_sensor_curl
Column Type Description Version
url TEXT The url for the request (required)* 3.9+
method TEXT

The HTTP method for the request.

Currently only supported method is "GET"

 3.9+
response_code INTEGER The HTTP status code for the response 3.9+
round_trip_time UNSIGNED_BIGINT Time taken to complete the request, in milliseconds 3.9+
bytes UNSIGNED_BIGINT Number of bytes in the response 3.9+
result TEXT The HTTP response body 3.9+
curl_code TEXT The Curl Code value plus the human readable translation of the code 3.9+
tls_protocol_version TEXT TLS protocol version number 3.9+
cert_subject TEXT Subject info on the server side cert 3.9+
cert_issuer TEXT Issuer info on the server side cert 3.9+
cert_public_key TEXT The public key value of the server side cert (DER Format) 3.9+
cipher_algorithm TEXT The discovered bulk encryption cipher algorithm 3.9+
key_exchange_algorithm TEXT The discovered key exchange algorithm 3.9+
mac_hash_algorithm TEXT The discovered Message Authentication Codes (MAC) hash algorithm 3.9+
cipher_strength INTEGER The strength of the bulk encryption cipher 3.9+
key_exchange_strength INTEGER The Key exchange algorithm length, in bits 3.9+
mac_hash_strength INTEGER The strength of the MAC hash 3.9+
is_tls_version_safe INTEGER Boolean value for if the TLS protocol version is deemed "safe" by the current sensor configuration 3.9+
is_tls_suite_safe INTEGER Boolean value for if the TLS suites are deemed "safe" by the current sensor configuration 3.9+
is_tls_cert_safe INTEGER Boolean value for if the TLS cert is deemed "safe" by the current sensor configuration 3.9+
configprop_overrides_successful INTEGER Boolean value for if the 'configprop_test_overrides' was successfully applied 3.9+
configprop_test_overrides TEXT JSON formatted configprop overrides that is temporarily applied to the sensor, for the duration of the HTTP GET being performed on the provided 'url'. Get technical help when attempting to craft the JSON 3.9+
proxy_server TEXT INPUT: Proxy server string that the sensor should use when attempting to establish the curl connection.OUTPUT: Proxy server string that the sensor used while attempting to establish the curl connection. 3.9+
proxy_credential_override TEXT INPUT: Proxy server credentials that the sensor should use during the curl request. Format is "user:password"(Only relevant if a proxy_server INPUT is also in use). 3.9+
use_alternate_cloud_port TEXT INPUT: Boolean value ('1' or '0') controlling if the sensor should use the alternate cloud port value (54443).OUTPUT: Boolean value ('1' or '0') informing if the sensor used the alternate cloud port value (54443). 3.9+
Note: cb_sensor_curl extensions perform a HTTP GET request against the provided 'url' using the current Carbon Black Cloud Windows Sensor Curl configuration settings.
Note:
  • Required: Must be present in the 'where' clause.
  • *Limitation: Do not use 'url' with a SQL "LIKE". It must be an exact value (url='<full_http_url>').
Table 6. cb_sensor_devices
Column Type Description Version
device_type TEXT The device type (for example, "DISK”, “CDROM”, etc.) 3.8+
interface_type TEXT The interface through which the device is connected (for example, “SCSI", “USB”, etc.) 3.8+
manufacturer TEXT The manufacturer of the device 3.8+
model_name TEXT The model name of the device 3.8+
friendly_name TEXT The user-friendly display name of the device 3.8+
product_id TEXT The product ID of the device 3.8+
serial_number TEXT The serial number of the device 3.8+
vendor_id TEXT The vendor ID of the device 3.8+
drive_letter TEXT The drive letter to which the device is mapped 3.8+
volume_guid TEXT The GUID of the device’s storage volume 3.8+
Note: cb_sensor_devices extensions return current device details that the Carbon Black Cloud Windows sensor detects.
Table 7. cb_sensor_files
Column Type Description Version
name TEXT Path name of the file (required) 3.8+
hash TEXT Hex string of the file's SHA256 hash (key, required) 3.8+
md5 TEXT Hex string of the file's MD5 hash (required) 3.8+
size INTEGER File size in bytes 3.8+
company TEXT The company who produces the file 3.8+
product TEXT The product the file belongs to 3.8+
version TEXT The product version 3.8+
original_name TEXT The original name of the file. It's not impacted by the file renaming 3.8+
description TEXT The description of the file 3.8+
file_version TEXT The file version. It may not be the same as the product version 3.8+
copyright TEXT Copyright information 3.8+
file_flags TEXT Some properties detected by the sensor 3.8+
locale TEXT Language 3.8+
signature_signer TEXT Who signed the file (Required) 3.8+
signature_issuer TEXT Who issued the signing certificate 3.8+
signature_state TEXT File signing state 3.8+
resolved_reputation TEXT The resolved/applied reputation 3.8+
resolved_reputation_source TEXT Which source the reputation was from while resolving 3.8+
Note: cb_sensor_files extensions return file information that the Carbon Black Cloud Windows sensor gathers. File information includes file metadata, applied reputation, and certificate details.
Note:
  • Required: Must be in the 'where' clause to narrow the result. If multiple required fields are listed, any of them will satisfy the requirement or can be AND or OR.
    Note: Examples: 
    SELECT * FROM cb_sensor_files WHERE name LIKE '%%cmd.exe';
SELECT * FROM cb_sensor_files WHERE hash IS 'b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450';
SELECT * FROM cb_sensor_files WHERE signature_signer LIKE '%windows%';
  • Limitation: Search by Hash/SHA256 or MD5 does not support 'like %'. The condition must be an exact match.
Table 8. cb_sensor_files_ex
Column Type Description Version
names TEXT All known path names of the file by the sensor (required) 3.8+
hash TEXT Hex string of the file's SHA256 hash (key, required) 3.8+
md5 TEXT Hex string of the file's MD5 hash (required, hidden) 3.8+
signature_signer TEXT Who signed the file (Required, hidden) 3.8+
dob TEXT Date of the birthday 3.8+
hash_state TEXT The state of the reputation for this hash 3.8+
executed TEXT Last time seen the file's execution 3.8+
tracked_execution_count INTEGER Number of times the executed file was seen by the sensor 3.8+
psc_info TEXT Some extra information detected by the sensor 3.8+
kernel_cache_residency TEXT The status of the file in the kernel cache residency 3.8+
persisted INTEGER 1: persisted in the database; 0: only in memory 3.8+
cache_lookup_count INTEGER Cache-hit count 3.8+
ux_info TEXT Information related for displaying 3.8+
apc_risk_level INTEGER

The risk level for non-malware detected by the local scanner.

  • -2: not detected
  • -1: no risk
  • 0~7: extremely low to extremely high
 3.8+
policy_delays TEXT Summary for Defense policy delay 3.8+
defense_policy TEXT Summary for Defense policy 3.8+
rules TEXT Summary for Defense rules 3.8+
Note: cb_sensor_files_ex extensions return file information that the Carbon Black Cloud Windows sensor gathers. It extends information in the cb_sensor_files table to include more detailed policy information and other file-related statistics that the sensor caches.
Note:
  • Required: Must be in the "where" clause to narrow the result. If multiple required fields are listed, any of them will satisfy the requirement or can be AND or OR.

    Examples: 
    SELECT * FROM cb_sensor_files WHERE name LIKE '%%cmd.exe';
SELECT * FROM cb_sensor_files WHERE hash IS 'b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450';
SELECT * FROM cb_sensor_files WHERE signature_signer LIKE '%windows%';
  • Hidden: Not shown from 'select *'. Must be explicitly stated in the 'select' fields.
  • Limitation: Search by Hash/SHA256 or MD5 does not support 'like %'. The condition must be an exact match.
Table 9. cb_sensor_logon_sessions
Column Type Description Version
unique_logon_id TEXT For Windows, it's LUID in ########-######## format 3.9+
linked_unique_logon_id TEXT For Windows, it's LUID in ########-######## format 3.9+
session INTEGER A terminal services session identifier 3.9+
user_id TEXT For Windows, it's SID 3.9+
user_name TEXT The account name of the security principal that owns the logon session 3.9+
user_domain_name TEXT The name of the domain used to authenticate the owner of the logon session 3.9+
user_principal_name TEXT The user principal name or email address for the owner of the logon session 3.9+
logon_type TEXT The value that identifies the logon method 3.9+
logon_time TEXT The time the session owner logged on 3.9+
logon_server TEXT The name of the server used to authenticate the owner of the logon session 3.9+
authentication_package TEXT The name of the authentication package used to authenticate the owner of the logon session 3.9+
dns_domain_name TEXT The DNS name for the owner of the logon session 3.9+
password_last_set TEXT The time when the user last changed the password 3.9+
last_logon_time TEXT The time that the session owner most recently logged on successfully 3.9+
last_failed_logon_time TEXT The time of the most recent failed attempt to log on 3.9+
failed_logon_attempts INTEGER The number of failed attempts to log on since the last successful log on 3.9+
active INTEGER Boolean value if the logon session is still active (1), or recently ended (0) 3.9+
Note: cb_sensor_logon_sessions extensions return information gathered by Carbon Black Cloud Windows Sensor.
Table 10. cb_sensor_processes
Column Type Description Version
pid INTEGER The process identifier 3.8+
id TEXT A formatted string that further identifies the process: <pid>-<start_time>-<siloID>. For example: “6320-132814763524433819-0" 3.8+
start_time TEXT The start-time of the process in FileTime format (100-nanosecond intervals since January 1st, 1601). 3.8+
terminated INTEGER 1: already terminated, 0 or absent: still alive 3.8+
user_name TEXT The name of the user that launched the process 3.8+
user_sid TEXT The SID of the user that launched the process 3.8+
file_name TEXT The absolute DOS path to the backing executable file 3.8+
interpreted INTEGER 1: if process is a script; 0: if the process is not a script. Can be empty for some processes (typical for sensor processes). 3.8+
hash TEXT The SHA256 hash of the executable or script 3.8+
script_name TEXT The name of the backing script file if process is a script 3.8+
script_hash TEXT The hash of the backing script, if process is a script 3.8+
cmd_line TEXT The command line of the process 3.8+
cmd_line_yara_tags TEXT Yara Tag(s) that apply to the process command line 3.9+
parent_pid INTEGER The PID of the process that launched this process 3.8+
parent_id TEXT A formatted string that further identifies the parent process: <pid>-<start_time>-<siloID>. For example: “6320-132814763524433819-0" 3.8+
parent_start_time TEXT The start-time of the parent process in FileTime format (100-nanosecond intervals since January 1st, 1601) 3.8+
parent_cmd_line TEXT The command line of the parent process 3.8+
hosted_services TEXT For svchost processes, this specifies the underlying service that is being hosted 3.8+
tags TEXT Internal sensor tags that contain additional process metadata (for example, “Cb:Psc:ProcessIsCBService”) 3.8+
file_type_tags TEXT Internal sensor tags that contain additional metadata (for example, "Cb:Defense:Script:CmdScript") 3.8+
integrity_level TEXT The integrity level of the process 3.8+
elevated INTEGER 1: process is elevated; 0: process is not elevated 3.8+
privileges TEXT Privileges the process has enabled (for example, SeImpersonatePrivilege) 3.8+
Note: cb_sensor_processes extensions return process information that the Carbon Black Cloud Windows sensor gathers.
Table 11. cb_sensor_processes_policy
Column Type Description Version
pid INTEGER The process identifier 3.8+
id TEXT A formatted string that further identifies the process: <pid>-<start_time>-<siloID>. For example: “6320-132814763524433819-0" 3.8+
policy_reputation TEXT The reputation of the process 3.8+
bypass_policy TEXT The bypass (ignore) policy assigned to the process 3.8+
allow_policy TEXT The allow (and log) policy assigned to the process 3.8+
terminate_policy TEXT The terminate policy assigned to the process 3.8+
deny_policy TEXT The deny policy assigned to the process 3.8+
parent_policy_reputation TEXT The reputation of the parent process 3.8+
parent_bypass_policy TEXT The bypass (ignore) policy assigned to the parent process 3.8+
parent_allow_policy TEXT The allow (and log) policy assigned to the parent process 3.8+
parent_terminate_policy TEXT The terminate policy assigned to the parent process 3.8+
parent_deny_policy TEXT The deny policy assigned to the parent process 3.8+
interpreter_policy_reputation TEXT If the process is a script, this is the reputation of the script interpreter 3.8+
interpreter_bypass_policy TEXT If the process is a script, this is the bypass policy assigned to the script interpreter 3.8+
interpreter_allow_policy TEXT If the process is a script, this is the allow policy assigned to the script interpreter 3.8+
interpreter_terminate_policy TEXT If the process is a script, this is the terminate policy assigned to the script interpreter 3.8+
interpreter_deny_policy TEXT If the process is a script, this is the deny policy assigned to the script interpreter 3.8+
script_policy_reputation TEXT If the process is a script, this is the reputation of the script 3.8+
script_bypass_policy TEXT If the process is a script, this is the bypass policy of the script itself 3.8+
script_allow_policy TEXT If the process is a script, this is the allow policy of the script itself 3.8+
script_terminate_policy TEXT If the process is a script, this is the terminate policy of the script itself 3.8+
script_deny_policy TEXT If the process is a script, this is the deny policy of the script itself 3.8+
applied_policy_reputation TEXT The reputation of the process, as applied by the kernel 3.8+
applied_bypass_policy TEXT The bypass policy of the process, as applied by the kernel 3.8+
applied_allow_policy TEXT The allow policy of the process, as applied by the kernel 3.8+
applied_terminate_policy TEXT The terminate policy of the process, as applied by the kernel 3.8+
applied_deny_policy TEXT The deny policy of the process, as applied by the kernel 3.8+
Note: cb_sensor_processes_policy extensions return process policy information that the Carbon Black Cloud Windows sensor gathers.
Table 12. cb_sensor_processes_reputation
Column Type Description Version
pid INTEGER The process identifier 3.8+
id TEXT

A formatted string that further identifies the process: <pid>-<start_time>-<siloID>. For example: “6320-132814763524433819-0"

 3.8+
effective_reputation TEXT The effective reputation of the process 3.8+
effective_reputation_source TEXT The source of the effective reputation 3.8+
cloud TEXT The reputation of the process as determined by the cloud 3.8+
pre_existing TEXT The reputation of the process as determined by whether the executable/script was already present on the sensor prior to install 3.8+
av TEXT The reputation of the process as determined by local AV 3.8+
it_tool TEXT The reputation of the process, as determined by whether it was dropped by a trusted IT tool 3.8+
certificate TEXT The reputation of the process, as determined by whether it was signed using an approved certificate 3.8+
hash TEXT The reputation of the process, as determined by whether the hash is approved or banned 3.8+
cb_sensor TEXT The reputation of the process, as determined by whether it is a sensor process 3.8+
operating_system TEXT The reputation of the process, as determined by whether it is a pre-determined OS hash 3.8+
Note: cb_sensor_processes_reputation extensions return process reputation information that the Carbon Black Cloud Windows sensor gathers.
Table 13. cb_sensor_status
Column Type Description Version
category TEXT A categorical grouping of status information:
  • General: General sensor details (sensor state, Device ID, policy name, etc.)
  • Version: Sensor version, SVN Revision, third-party tool versions, etc.
  • BackgroundScan: Details on the configuration and state of the Background scan
  • Cloud: Details about the sensor's connectivity to the Cloud backend
  • Queue: Details about the current queue status
  • Diagnostic: Logging level, maintenance mode, etc.
  • Rules: Details about any applied DRE policies
  • LocalScanner: Details pertaining to the local scanner configuration/state
  • Alarms: Details on any triggered alarms
 3.8+
name TEXT Name of the status data 3.8+
value TEXT Value of the status data 3.8+
Note: cb_sensor_status extensions return current status details for the Carbon Black Cloud Windows Sensor. This data is similar to the output of the repcli status command.
Table 14. cb_sensor_volumes
Column Type Description Version
name TEXT The volume name 3.8+
guid TEXT The volume GUID 3.8+
file_system TEXT The volume’s file system type (for example, NTFS, FASTFAT, etc.) 3.8+
device_type INTEGER The device type as defined by internal Windows values. See https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/specifying-device-types 3.8+
device_characteristics INTEGER A bitmask of internal Windows values that provide additional information about the volume’s device 3.8+
serial_number INTEGER The serial number of the volume 3.8+
alignment_requirement INTEGER An internal Windows value that defines the alignment requirement of the volume for data transfers 3.8+
sector_size INTEGER The volume sector size 3.8+
shadow_copy INTEGER 1: the volume is a shadow-copy or “snapshot" volume 3.8+
device_manufacturer TEXT The manufacturer of the volume’s device 3.8+
device_name TEXT The name of the volume’s device 3.8+
device_serial_number TEXT The serial number of the volume’s device 3.8+
Note: cb_sensor_volumes extensions return current volume details that the Carbon Black Cloud Windows sensor gathers.
Note: For information about RepCLI commands, see Managing Sensors by using RepCLI.