EDR: How to View Sensor Communication Certificates on Windows Sensors 6.2.3 and Above
search cancel

EDR: How to View Sensor Communication Certificates on Windows Sensors 6.2.3 and Above

book

Article ID: 287949

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to view the certificates used for sensor communication

Environment

  • EDR Sensors: 6.2.3 and Higher
  • Microsoft Windows: All Supported Versions

Resolution

  1. On the endpoint, run mmc.exe
  2. File > Add/Remove Snap-in..
    • Snapin
  3. Click Certificates then Add Certificates (Local Computer)
    • Certificates
  4. Under the Certificates path a CarbonBlack folder is created upon installing the sensor
    • CarbonBlack Folder

Additional Information

  • Client Certs are based upon the Sensor Group the endpoint is in
  • By Default, the legacy self-signed certificates is used. If using a custom server certificate and it's assigned to the sensor group, the custom certificate will be replace the self-signed in the CarbonBlack certificate folder