Carbon Black Cloud Alerts API

Can I search alerts grouped by threat with this API?

Yes. POST /grouped_alerts/_search collapses related alerts into a single record per threat_id and accepts the same criteria operators as POST /alerts/_search. Companion endpoints POST /grouped_alerts/_facet and POST /grouped_alerts/_histogram provide faceted counts and time-series statistics on the grouped view.

How do I export Carbon Black alerts to CSV?

Submit POST /alerts/_export with a search payload to start an asynchronous export job. Carbon Black processes the export in the background; the response returns a job identifier you can use to retrieve the CSV when the job completes.

What are the rate limits for the Carbon Black Cloud Alerts API?

The OpenAPI specification does not declare explicit numeric rate limits. Carbon Black Cloud applies per-API-key throttling at its gateway; if you receive 429 responses, back off and reduce concurrency on /alerts/_search and the histogram/facet endpoints. Refer to your Carbon Black Cloud console for the limits attached to your key.

How do I triage Carbon Black alerts with an AI agent through Jentic?

Run `pip install jentic`, then use Jentic to search for the alert search operation with the query "search carbon black alerts", load the schema, and execute with your criteria object. Jentic calls POST /alerts/_search with your X-AUTH-TOKEN, returning structured alerts the agent can annotate by chaining POST /alerts/{alertId}/notes.

Can I add notes and tags to threats programmatically?

Yes. POST /threats/{threatId}/notes adds an investigator note to a threat and DELETE /threats/{threatId}/notes/{noteId} removes one. POST /threats/{threatId}/tags/{tag} attaches a state tag (for example, 'investigating') and DELETE /threats/{threatId}/tags/{tag} removes it. The same notes pattern applies to alerts via /alerts/{alertId}/notes.

How do I check whether my alert search query is valid before running it?

POST /alerts/_validate accepts a search payload and returns whether the query syntax is valid without executing it. Combine with GET /alerts/search_suggestions to discover available field names and complete partial queries before submission.

Can I limit what my agent is allowed to do with the Carbon Black Cloud Alerts API?

Yes. Because you run Jentic One yourself, you write the rules that decide which Carbon Black operations and which credentials your agent may use. Since the org_key sits in the base path and the alert and threat ids sit in the URL, you can pin the agent to a single org and to a chosen set of operations, for example allowing POST /alerts/_search and POST /alerts/_facet for read-only triage while keeping note-writing on POST /alerts/{alertId}/notes and threat tagging on POST /threats/{threatId}/tags/{tag} out of reach. The agent can only call the endpoints you have explicitly permitted, and it receives the X-AUTH-TOKEN only when it runs an allowed operation.