CB Response: How to Disable Process Banning Across All Sensor Groups

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To disable Process Banning across all sensor groups at the same time.

Environment

• CB Response Server: All Versions

Resolution

1. From the CB Response Application Server, open terminal.
2. Edit /etc/cb/cb.conf

vi /etc/cb/cb.conf

3. Find the Banning Settings header.
4. Change the BanningEnabled value to "False"
5. Save changes.
6. Restart services.

service cb-enterprise restart

Additional Information

Changing BanningEnabled to false within cb.conf causes the Process Banning option within all sensor groups to disappear in the console.