CB Defense: How to verify signature pack version using registry key value on a Windows 10 endpoint

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to determine signature pack version using registry values

Environment

• CB Defense Sensor all supported versions
• Microsoft Windows 10

Resolution

In the registry navigate to:

1. Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbDefense\Scanner
2. SnapEngineVersion is the key Name value
3. Signature pack version is the Data value

Additional Information

This method can be used in the following circumstances: 

• Repcli authentication was not enabled upon sensor installation
• No access to the CB Defense console
• Unauthorized to use Repcli
• It is not recommended to rely on this registry key as it is subject to change