How to Identify a VDI Clone's Base

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to identify the base device associated with a clone, using the Chrome browser for Windows

Environment

• Carbon Black Cloud: All Supported Versions

Resolution

1. Go to the Inventory -> Endpoints tab
2. Press F12 to bring up developer console
3. Click the Network Tab
4. Press F5 to refresh the page
5. Sort by the "Name" column by clicking next to the column header ("Name")
6. Click the object named "_search"
7. On the right-hand-side under the Response tab, each endpoint will be listed under "results"
8. The first endpoint listed on the right-hand-side will be entry 0 and corresponds to the first endpoint listed in the "All Sensors" section, which should be still displayed on the left-hand-side, entry 1 corresponds to the second endpoint listed, etc
9. Click on the entry you would like to identify the base machine for
10. Scroll down the entry's information and look for the field "vdiBaseDevice", which will list the Device ID of the endpoint's base image