Migrating Hosted EDR to On-prem EDR

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

To migrate sensors from Hosted EDR (HEDR) to an On-prem EDR solution.

Environment

• Hosted EDR: 7.8.0
• EDR: 7.8.0

Resolution

The HEDR certificates, watchlists and sensors will migrate.  The older data (cbevents, binaries, etc) do not migrate.

The overall procedure to migrate to On-prem EDR:

1. Contact the Account Manager or MSSP for the HEDR instance.  If the Account Manager is not accessible, notify CB Support.
   The Account Manager is expected to:
   a. Set up a new record for on-prem EDR instance.
   b. Generate a new RPM required for installation.
   c. Discuss the opportunity for Professional Services to perform the migration (Quick and easy).
   
   
2. Open a Support Case to obtain:
   a. The certificates.  These are essential for sensor migration.
   b. The watchlists & optionally a Watchlist Report.   The watchlists should be exported using cbapi.  The Watchlist Report contains hints to improve accuracy and performance.
   c. Average documents ingested per day in HEDR for this instance.  This value should be used to calculate the resources needed for an On-prem EDR.
   
   
3. Determine the correct sizing for the On-prem EDR.  This is based on the average documents ingested per day and the Operational Environment Requirements (OER).
   
   
4. Install the RPM on the On-prem Primary EDR server.  Save the RPM, it contains the license and alliance certificates which are unique for each organization.
   
   
5. Install EDR. 
   
   
6. Backup the certificates created by the EDR install.
   

   cp -pr /etc/cb/certs /root/

7. The on-prem EDR requires a) carbonblack-alliance-client* key pair from step #6 and b) HEDR key pairs for cb-server, cb-client, cb-redis and cb-redis-ca. 
   Place the HEDR bkup file from the Support Case into the /tmp/ directory on the Standalone or Primary On-prem EDR server.  Restore the HEDR certificates onto the on-prem EDR server.  This automatically moves the current on-prem certs to a subdirectory named /etc/cb/certs/orig.<date>.
   

   /usr/share/cb/cbssl restore --in=/tmp/<CB alias>.certs.bkup
   <enter the password provided by CB Support>

8. Move the correct Alliance certificate key pair (from Step 6) back to the /etc/cb/certs directory.   
   

   mv -f  /etc/cb/certs/orig.<date>/carbonblack* /etc/cb/certs/
   

9. Confirm the certificates are correct (this is important to smoothly migrate the sensors).  The hash for cb-server, cb-client, cb-redis and cb-redis-ca should match the certhash file, that came with the bkup file.  The carbonblack-alliance-client md5 should NOT match the certhash file.
   
   
10. Check the Alliance certificates' level of security.   If the Alliance certs are using SHA1 algorithm, request CB Support provide the updated SHA256 Alliance certificate pair.
    

    openssl x509 -noout -text -in /etc/cb/certs/carbonblack-alliance-client.crt | grep sha

11. Initialize the EDR server.
    
    
12. Check the permissions on the /etc/cb/certs directory.
    

    chown -R root:cb /etc/cb/certs
    chmod 755 /etc/cb/certs
    chmod 644 /etc/cb/certs/*.crt
    chmod 640 /etc/cb/certs/*.key

13. Add minions as needed to meet OER.
    
    
14. Import the watchlists using cbapi.
    
    
15. Start the On-prem EDR.
    

    Standalone:
         systemctl start cb-enterprise
    Cluster:
         /usr/share/cb/cbcluster start

16. Select a HEDR Sensor Group to migrate to the On-prem EDR, then create an On-prem EDR group to match.
    
    
17. Modify the HEDR's Sensors > Group > variable Server URL to the On-prem EDR server name. (Use HTTPS and the correct port.) 
    
    
18. Repeat 13 & 14 until the groups have migrated.

Additional Information

• Solr and Postgres data cannot be migrated to the On-prem EDR.   The events, binary collection, user accounts, etc would start fresh on the new On-prem EDR.  
• The watchlists can alternatively be provided in a CSV file that would need to be manually added to the On-prem EDR.