The VMWare Carbon Black Defense Operation allows a ThreatQ user to query their Carbon Black Defense instance for any sensors/devices that have generated events containing an indicator.

The operation provides the following actions:

• Query Sensor Events

The operation is compatible with filename and SHA-256 indicator types.