EDR: How to Utilize MAC Address for Sensor VDI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to setup sensor VDI to utilize MAC Address

Environment

EDR Server: All Versions
EDR Sensor: All Versions

Resolution

1. Open /etc/cb/cb.conf and enter the following configuration to the bottom of the file for Master and Minions

   NewRegistrationCallbackModulePath=/usr/share/cb/plugins/default_new_sensor_registration_callback_MacAddress.py
   NewRegistrationCallbackClassName=DefaultNewRegistrationCallback

2. Download the file from the EDR secure link:
   1. 6.5.2 and below: default_new_sensor_registration_callback_MacAddress (6.x)
   2. 7.0.1 and above: default_new_sensor_registration_callback_MacAddress (7.x)
   • If you want to rename the file, make sure to use the filename in NewRegistrationCallbackModulePath=
3. Copy the python script into to the /usr/share/cb/plugins folder
4. Restart server services to ingest the change. 

Additional Information

• Please review the CB Response Integration Guide for more information on VDI Support
• To confirm sensors are correctly mapping, follow this article to setup verbose logging. CB Response: How to Enable Logging for VDI SensorID Lookup
• 7.0.1 and above utilize Python 3 and does not support the original encode("hex") format being used in the 6.x script.