CB Defense: How to Force Sensors to Update After Implementing Signature Pack Fix

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

After implementing the Signature Pack fix for the August 1, 2019 issue https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-Signature-Pack-Version-Has-Not-Updated-Since-August-1/ta-p/77662, force Sensors to update immediately rather than allowing the update window to elapse

NOTE: For 3.3.x.x and higher Sensors with RepCLI enabled, the updates can be forced locally: https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-Force-3-3-x-x-and-Higher-Sensors-With-RepCLI/ta-p/77930

Environment

• CB Defense PSC Sensor: 3.0.x.x and higher
• CB Defense PSC Console: All versions
• RepCLI Authentication is not available or not enabled
• Microsoft Windows: All supported versions

Resolution

There are two options available:
A. Reboot the device once more to force the Sensors to obtain updates immediately
B. Perform a policy update to force the Sensor to obtain updates rather than allowing the Sensor to update on its own (no reboot required)

1. Navigate in the Console to Enforce > Policies > Select policy with affected Sensors
2. Disable both "Scanner Config On-Access File Scan Mode" and "Signature Updates Allow Signature Updates" options
3. Save the changes and assign policy (if necessary)
4. Allow time for the Sensors in the policy to update policy (Adding a Sensor UI detail message can help confirm when new policies are received)
5. Open the same policy for editing
6. Enable both "Scanner Config On-Access File Scan Mode" and "Signature Updates Allow Signature Updates" options
7. Save the changes

NOTE: Another policy change that can help speed the initial updates is changing the update schedule from 4 to 2 hours

Additional Information

The Signature pack version will be updated to the following or later once issue is resolved 

8.16.20.120