CB Defense: How to Force Sensors to Update After Implementing Signature Pack Fix
book
Article ID: 285548
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
After implementing the Signature Pack fix for the August 1, 2019 issue https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-Signature-Pack-Version-Has-Not-Updated-Since-August-1/ta-p/77662, force Sensors to update immediately rather than allowing the update window to elapse
NOTE: For 3.3.x.x and higher Sensors with RepCLI enabled, the updates can be forced locally: https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-Force-3-3-x-x-and-Higher-Sensors-With-RepCLI/ta-p/77930
Environment
CB Defense PSC Sensor: 3.0.x.x and higher
CB Defense PSC Console: All versions
RepCLI Authentication is not available or not enabled
Microsoft Windows: All supported versions
Resolution
There are two options available: A. Reboot the device once more to force the Sensors to obtain updates immediately B. Perform a policy update to force the Sensor to obtain updates rather than allowing the Sensor to update on its own (no reboot required)
Navigate in the Console to Enforce > Policies > Select policy with affected Sensors
Disable both "Scanner Config On-Access File Scan Mode" and "Signature Updates Allow Signature Updates" options
Save the changes and assign policy (if necessary)
Allow time for the Sensors in the policy to update policy (Adding a Sensor UI detail message can help confirm when new policies are received)
Open the same policy for editing
Enable both "Scanner Config On-Access File Scan Mode" and "Signature Updates Allow Signature Updates" options
Save the changes
NOTE: Another policy change that can help speed the initial updates is changing the update schedule from 4 to 2 hours
Additional Information
The Signature pack version will be updated to the following or later once issue is resolved