EDR: Linux Sensor VDI Receives 'localhost' SensorID When Checking In With Server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When DNS Name is selected as a metric for VDI and a Linux sensor is packaged up as an image, as detailed in steps 2-5 in the 'Golden Image' section found here.  The sensor retrieves the SensorID of another sensor, often times: 'localhost'.

Environment

• EDR Server: 7.4+
• EDR Linux Sensor : 7.x+

Cause

• The sensor uses the /etc/hosts file to determine the DNS name. 
• The first hostname found in the /etc/hosts file will be the associated DNS name, hence the sensor getting a sensor ID for a sensor with a hostname/DNS name of 'localhost'.

Resolution

• To resolve this issue, break apart the localhost and DNS name loopback addresses as show below:
• From:

127.0.0.1 localhost localhost.localdomain edr-server.corporate-domain.local edr-server

• To:

127.0.0.1 edr-server.corporate-domain.local edr-server
127.0.0.1 localhost localhost.localdomain

• Once complete, attempt to retrieve a new sensor id as detailed in steps 2-5 in the 'Golden Image' section found here.