CB Response: Why Do CB Response Sensors Continue Installation After Detecting An Unsupported Kernel?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CB Response sensor detects an unsupported kernel during installation to endpoint.
• CB Response sensor will continue installation after detecting an unsupported kernel.

Environment

• CB Response Sensor: 6.2.1 and Higher
• RHEL: 7.3 and Higher

Resolution

This behavior is by design:

• A supported kernel could be installed later.
• The daemon still communicates with the server after install. It will report to the server that the kernel version is unsupported, what the kernel version is, and other stats about the machine.
• Some facilities, such as LiveResponse, work without a supported kernel.