EDR: How to Downgrade Event Forwarder

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to downgrade Event Forwarder to a previous release.

Environment

• EDR:  All Versions
• Event Forwarder: All Versions

Resolution

1. Backup your /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf for a safe location.  Downgrade will not overwrite this file, this is only for safely.
2. Stop Event Forwarder

CentOS 6:
service cb-event-forwarder stop

CentOS 7:
systemctl stop cb-event-forwarder

3.  List all event-forwarder version in the CbOpenSource Yum repo and note the target version string:

yum list --showduplicates cb-event-forwarder

example:
cb-event-forwarder.x86_64     3.7.0-1.el6

4. Use yum to downgrade to the older version

yum downgrade cb-event-forwarder-<version>.x86_64

example:
yum downgrade cb-event-forwarder-3.7.0-1.el6.x86_6

5. Confirm downgrade

yum info cb-event-forwarder

6. Start Event Forwarder

CentOS 6:
service cb-event-forwarder start

CentOS 7:
systemctl start cb-event-forwarder