EDR: How to Install the Linux sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to install the EDR Linux sensor

Environment

• EDR Sensor: All Versions
• Linux: All Supported Versions

Resolution

To install sensors on Linux endpoints:

1. In the navigation bar of the EDR console, click Sensors to display the Sensors page.
2. In the Groups panel, select the sensor group for which you want to install the sensor package.
3. From the Download Sensor Installer drop-down list, select Linux Standalone RPM. The sensor package file is downloaded to your system.
4. In the operating system, do the following:
   1. Copy the <install package name>.tar.gz sensor installation package to the Linux endpoint.
   2. Untar the <install package name>.tar.gz file to a temporary folder. Do not skip this step. For example, at a command prompt and from the directory where the file is installed, run this command: tar -zxvf <install file name>.tar.gz
   3. From the extracted .tar.gz file, run the .sh file and then follow the installation prompts. This installs the Linux sensor using the configuration provided in the sensorsettings.ini file.

      ./CarbonBlackClientSetup-linux-<version>.sh

5. After this process is complete, the Linux sensor is installed and running. The Sensors page shows the sensor as registered and checking into the EDR server.

Additional Information

• To install sensors on Linux systems, you must be a root user or have “sudoer” permissions and run the installer with “sudo”.
• To have access to the Download Sensor Installer controls for a sensor group, you must be one of the following:
  • A user that is a member of a team that has either the Viewer or Analyst role for the sensor group
  • For on-premise installations, a Global Administrator
  • For cloud installations, an Administrator