EDR: How To Install Yara Connector When Server is not Connected to Internet

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to install Yara Connector when EDR server does not have internet access.

Environment

• EDR (formerly known as CB Response Server): All Versions
• Yara Connector: Version 1.3

Resolution

1. Download the Yara Connector .rpm file on to a Linux box with internet access:

curl -Ok https://opensource.carbonblack.com/release/x86_64/python-cb-yara-connector-1.3-6.x86_64.rpm

2. Move the .rpm onto the offline box
3. Install the rpm with yum and configure the Yara connector:
   1. Copy 'python-cb-yara-connector-1.3-6.x86_64.rpm' file to '/etc/yum.repos.d' directory
   2. Run following command to install connector: yum install python-cb-yara-connector
   3. Copy '/etc/cb/integrations/yara/connector.conf.example' to '/etc/cb/integrations/yara/connector.conf'
   4. Place the Carbon Black API key into the 'carbonblack_server_token' variable
   5. Place the Carbon Black Server's base URL into the 'carbonblack_server_url' variable
   6. Point the Yara connector to a directory of Yara rule files by editing the 'yara_rule_directory' variable (A set of example rules are included in the /usr/share/cb/integrations/yara/example_rules directory)
   7. Start 'cb-yara-connector' service by running following command as 'root' user:

service cb-yara-connector start