EDR: How to setup Windows Sensors for Proxy Communication

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to setup Windows sensors for proxy communication

Environment

• EDR Sensors: All Versions
• Microsoft Windows: All Supported Versions

Resolution

• Proxy Options
  • "server:port" | Where server is the proxy server and port is the port of the proxy server
  • "@wpad" | 6.2.3 and above only. Instructs the sensor to auto-detect proxy with WPAD protocol.
  • "@pacurl:URL" | 6.2.3 and above only. Where URL is the URL of the PAC file to download and use the proxy configured in the file
• To add the proxy setting follow one of the two options
  • Open the zip file of the installer contents and modify the sensorsettings.ini file by adding the Proxy config anywhere in the file. For example, adding autodetect proxy

    Proxy=@wpad

  • If the sensor is already installed, the following registry edit command can be used

    reg add HKLM\SOFTWARE\CarbonBlack\config /v Proxy /t REG_SZ /d @wpad

Additional Information

• 6.2.3 and above sensors have enhanced behavior for proxy communication
• The sensor gets the beginning packet and sends it to the user service to check if it's going through a proxy
• If communication fails over proxy, the sensor will try using direct communication