Carbon Black Cloud: How to Designate a Policy At Install on Linux Sensors

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to assign a policy to the Carbon Black Cloud sensors for Linux at install

Environment

• Linux: All Supported Versions
• Carbon Black Cloud Linux Sensor: 2.8.3.300614 and later

Resolution

Follow the steps below:

1. Install the sensor

sudo ./install.sh

2. Update cfg.ini with the desired policy name (please note GroupName refers to a policy name)

echo 'GroupName=Linux Policy' | sudo tee -a /var/opt/carbonblack/psc/cfg.ini

3. Populate the company code enclosing the company code in single quotes, this will populate the line "CompanyCode" in cfg.ini with the corresponding code

sudo /opt/carbonblack/psc/bin/cbagentd -d 'company_registration_code'

4. Confirm the changes took place

cat /var/opt/carbonblack/psc/cfg.ini

5. Start the sensor daemon

sudo systemctl start cbagentd

 

Additional Information

Upon completing the steps above, the sensor will display "Manually Assigned" as its group and the policy as defined by GroupName above.
IMPORTANT:  This process should only be done prior to first checkin/sensor start.  Doing this process after initial check/registration can cause "duplicate key error" and sensor disconnect.