Carbon Black EDR (formerly Cb Response)

How to install or upgrade an air-gapped Carbon Black EDR server that does not have internet access.

A. Prerequisite

An Internet facing caching server is required to download the rpm packages necessary to perform the EDR Installation and Upgrades.
- Must match the same OS and kernel version of the air-gapped server. Failure to do this will cause yum to fail on version dependencies.
- This machine does not need to meet the Operating Environment Requirements (OER).
- Do not install or configure the EDR application on the caching server, this can cause issues with downloading all the required packages for future upgrades.
An air-gapped server that meets the OER sizing guide.

B. Configure the Caching Server

Install the appropriate OS on the caching server.
Download the license RPM from the entitlements support.broadcom.com portal and install per the instructions. Copy this file to the air-gapped server also.
Download the License RPM
Download the package generation, follow the steps to get the script, your authentication token and run the generate_cbserver_repo.sh script per the instructions. Copy this file to the air-gapped server also.
Authenticate to Packages Repository
Install the following utilities required to create the repo.
```
yum install yum-utils -y
yum install createrepo -y
```

Add these two configs into /etc/yum.conf

keepcache=1
cachedir=/var/cache/yum/$basearch/$releasever

Make the cache directory. Note: Where 8 is the major version of the OS you are on.
```
mkdir -p /var/cache/yum/x86_64/8/CarbonBlack
```
Change into the cache directory the remainder of the steps require you to be in this working directory,
```
cd /var/cache/yum/x86_64/8/
```
Clean the yum cache
```
yum clean all
```

For OS version 8 and higher, run the following command.

sudo yum module disable postgresql redis python38 python39

Download the application directly to the directory

yum install cb-enterprise --downloadonly --downloaddir=/var/cache/yum/x86_64/8/CarbonBlack

Run the create repo to generate the repodata required for the air gapped server to use the files
```
createrepo CarbonBlack
```

Gzip the directory and move it to the air gapped server.

tar --selinux -cvzf /tmp/edr_yum_cache.tar.gz CarbonBlack/

For clustered instance, the same steps will need to be performed on each node.

Move the license RPM downloaded from the entitlements support.broadcom.com portal onto this box and install it via the instructions here.
Download the License RPM
Copy the package run on the internet facing server that contains the generate_cbserver_repo.sh script. Extract the files and run the script.
- You do not need the username or auth token, when it requests type in a random string. The URL will later be modified.
  Authenticate to Packages Repository
Open the /etc/yum.repos.d/CarbonBlack.repo file for editing. Modify the baseurl= to the following:
```
baseurl=file:///var/cache/yum/$basearch/$releasever/CarbonBlack
```
Clean the yum cache
```
yum clean all
```
Make the cache directory. Note: Where 8 is the major version of the OS you are on.
```
mkdir -p /var/cache/yum/x86_64/8
```
Change into the cache directory the remainder of the steps require you to be in this working directory,
```
cd /var/cache/yum/x86_64/8/
```
Extract the repo files from the internet facing tar capture
```
tar --selinux -xvzf /tmp/edr_yum_cache.tar.gz
```

For OS version 8 and higher, run the following command.

sudo yum module disable postgresql redis python38 python39

Do not follow these steps for upgrade. Running cbinit will result in a loss of data.

Run the following command to install the RPM files

yum install cb-enterprise --disablerepo="*" --enablerepo="CarbonBlack"

Follow the official documentation for initialization and adding minion nodes (for clustered)
1. Initialize and Configure a New Server
2. Cluster Installation and Management
Start the EDR Server services upon completion.
How to Start, Stop and Restart EDR Application Services

Stop the EDR Server Services.
How to Start, Stop and Restart EDR Application Services

Update the application on each server node.

yum update cb-enterprise --disablerepo="*" --enablerepo="CarbonBlack"

Finalize with cbupgrade on each server node.
```
/usr/share/cb/cbupgrade
```
Start the EDR server services upon completion.
How to Start, Stop and Restart EDR Application Services

This staging/caching server must be the same OS (CentOS, RHEL, Rocky, Alma), OS version and patches as the actual target EDR server.
- This guide does not cover upgrading the air-gapped machines OS related packages. Please see OS documentation for steps to perform OS level upgrades on an air-gapped server.
- Any OS level updates need to be performed on both servers simultaneously
Can a Direct Download Link be Provided for an Air-gapped Server?