-
Notifications
You must be signed in to change notification settings - Fork 61
VMware Carbon Black EDR
Cori Smith edited this page Mar 3, 2023
·
3 revisions
Nuances and common questions when using VMware Carbon Black EDR
Surveyor builds queries to fit the format
<INSERT_YOUR_QUERY_PARAMETERS> AND <INSERT_FILTERS>
So when using the --query parameter or the query field in a definition file, you need to format your query to fill in the <INSERT_YOUR_PARAMETERS> section.
That is followed by the <INSERT_FILTERS> section which is populated if you use the --hostname, --username, or time filter parameters.