CB Response: How to Collect Sensor Event or Store Logs (Windows)
book
Article ID: 287930
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Collecting Sensor event or binary store logs that get set up to the server
Environment
Carbon Black Sensor: All Versions
Microsoft Windows: All Supported Versions
Resolution
- In the console, sync the example sensor
- On the sensor itself, force a check-in to force the sync
sc control carbonblack 200
- Stop the sensor services. Interrogate will confirm services are stopped
sc stop carbonblack
sc stop carbonblackk
sc interrogate carbonblack
- Modify the registry to point to a nonexistent server. (Note the current value to replace in step 10). See Additional Notes for other options
Master server:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Carbonblackk\SensorBackendServer
Submission Server:
Binary or Eventlog upload server HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Carbonblackk\DataServer
- Start the sensor service to start capturing
sc start carbonblack
- Reproduce the event log issue
- Dump a diagnostics file immediately after reproduction
sc control carbonblack 201
- Stop the sensor services again
sc stop carbonblack
sc stop carbonblackk
sc interrogate carbonblack
- Copy the following directories to a folder outside of C:\Windows\CarbonBlack
C:\Windows\CarbonBlack\Eventlogs
C:\Windows\CarbonBlack\store\catalog
C:\Windows\CarbonBlack\Diagnostics
- Revert the registry changes from step 4 to allow the sensor to connect back up to the server
- Start the sensor service again
sc start carbonblack
- Please zip up the collected contents and upload to the case via the cbvault link.
Additional Information
There are other options to the registry change. The sensor needs to be disconnected from the server in order to keep the event logs
- Modify C:\Windows\System32\Drivers\etc\hosts file not point to the server
- Add a firewall restriction on the endpoint to the server
- Disable the network on the endpoint
- Stop the servers cb-nginx service. This will affect all sensors submitting for that short period of time. This would need to be on Master and Minions
service cb-nginx stop
Feedback
thumb_up
Yes
thumb_down
No