EDR: Install Unified Viewer in Non-Interactive Mode

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to install Unified Viewer in non-interactive mode

Environment

• EDR Unified View:  7.5 and higher

Resolution

To install Unified Viewer in non-interactive mode:
1. Obtain the RPM installation package for Carbon Black EDR.
2. Install the RPM package using the following command:

sudo rpm -ivh carbon-black-release-..x86_64.rpm

3. Disable CarbonBlack repo by modifying /etc/yum.repos.d/CarbonBlack.repo and set

enabled=0

4. Create the following new repo file specific to Carbon Black EDR Unified View as /etc/yum.repos.d/CarbonBlackUnifiedView.repo:

[CbUnifiedView]
name=CbUnifiedView
baseurl=https://yum.distro.carbonblack.io/unifiedview/stable/$releasever/$basearch/
gpgcheck=0
enabled=1
metadata_expire=60
sslverify=1
sslclientcert=/etc/cb/certs/carbonblack-alliance-client.crt
sslclientkey=/etc/cb/certs/carbonblack-alliance-client.key

5. For EL6 and EL7 servers, run the following command:

$ sudo yum install cb-unifiedview

For EL8 servers, run the following commands:

$ sudo yum module disable postgresql redis
$ sudo yum install cb-unifiedview

6. Type y to confirm that you want to install the available packages comprising the Carbon Black EDR Unified View installation.
7. Create the 'input file' for the cbinituv command. Perhaps name the file 'cbuv'.

[Config]
root_storage_path=/var/cb/data
admin_username=admin
admin_first_name=Global
admin_last_name=admin
[email protected]
admin_password=test
apply_iptables=1
service_autostart=1
force_reinit=1
default_sensor_server_url=https://<server FQDN>
alliance_comms_enabled=0
alliance_statistics_enabled=0
alliance_vt_hashes_enabled=0
alliance_vt_binaries_enabled=0
alliance_bit9_hashes_enabled=0
alliance_bit9_binaries_enabled=0

8. Run the cbinituv command in non-interactive mode using the 'input file'.  This will automatically the accept the EULA, setup the admin account and complete the environment (firewall, database and encryption key).

/usr/share/cb/cbinituv cbuv