EDR: New binaries no longer available in UI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Alliance Sharing is disabled
• /etc/cb/cb.conf has setting KeepAllModuleFiles=0

Environment

• EDR Server: 6.1 and Above
• EDR Sensor: All Versions

Cause

The combination of settings is removing the binaries from the server and preventing download from Alliance. 

Resolution

There are two options

1. Enable Alliance Sharing so binaries can be downloaded
   1. In the UI navigate to Sharing Settings from the username drop-down
   2. Check Enable Alliance Communication
2. Change the setting in cb.conf to keep all module files
   1. Edit /etc/cb/cb.conf
   2. Change KeepAllModuleFiles=0 to KeepAllModuleFiles=1

Additional Information

• If option 2 was performed, binary files will have to be purged in order to avoid running out of disk space. See https://community.carbonblack.com/t5/Knowledge-Base/Modulestore-Filling-Disk-When-Alliance-Sharing-Is-Disabled/ta-p/43887