class_docstr: CarbonBlackOutput handles all alert dispatching for CarbonBlack
docstr: Send ban hash command to CarbonBlack
  
  Publishing:
      There is currently no method to control carbonblack's behavior with publishers.
  
  Args:
      alert (Alert): Alert instance which triggered a rule
      descriptor (str): Output descriptor
  
  Returns:
      bool: True if alert was sent successfully, False otherwise
docstr_tok: ["Send","ban","hash","command","to","CarbonBlack","Publishing",":","There","is","currently","no","method","to","control","carbonblack","'s","behavior","with","publishers",".","Args",":","alert","(","Alert",")",":","Alert","instance","which","triggered","a","rule","descriptor","(","str",")",":","Output","descriptor","Returns",":","bool",":","True","if","alert","was","sent","successfully",",","False","otherwise"]
code: def _dispatch(self, alert, descriptor):
      """Send ban hash command to CarbonBlack
  
      Publishing:
          There is currently no method to control carbonblack's behavior with publishers.
  
      Args:
          alert (Alert): Alert instance which triggered a rule
          descriptor (str): Output descriptor
  
      Returns:
          bool: True if alert was sent successfully, False otherwise
      """
      if not alert.context:
          LOGGER.error(
              "[%s] Alert must contain context to run actions",
              self.__service__,
          )
          return False
  
      creds = self._load_creds(descriptor)
      if not creds:
          return False
  
      client = CbResponseAPI(**creds)
      carbonblack_context = alert.context.get("carbonblack", {})
  
      # Get md5 hash 'value' passed from the rules engine function
      action = carbonblack_context.get("action")
      if action == "ban":
          binary_hash = carbonblack_context.get("value")
          # The binary should already exist in CarbonBlack
          binary = client.select(Binary, binary_hash)
          # Determine if the binary is currently listed as banned
          if binary.banned:
              # Determine if the banned action is enabled, if true exit
              if binary.banned.enabled:
                  return True
              # If the binary is banned and disabled, begin the banning hash operation
              banned_hash = client.select(BannedHash, binary_hash)
              banned_hash.enabled = True
              banned_hash.save()
          else:
              # Create a new BannedHash object to be saved
              banned_hash = client.create(BannedHash)
              # Begin the banning hash operation
              banned_hash.md5hash = binary.md5
              banned_hash.text = "Banned from StreamAlert"
              banned_hash.enabled = True
              banned_hash.save()
  
          return banned_hash.enabled is True
      LOGGER.error(
          "[%s] Action not supported: %s", self.__service__, action
      )
      return False
  
file_path: streamalert/streamalert/alert_processor/outputs/carbonblack.py
imports: from collections import OrderedDict
  from cbapi.response import BannedHash, Binary, CbResponseAPI
  from streamalert.alert_processor.outputs.output_base import OutputDispatcher, OutputProperty, StreamAlertOutput
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 2 for calling the CarbonBlackOutput obj's underlying member method code with example usage: obj._dispatch(alert, descriptor) and returns: False, False, False, unknown, True