Cb Response: How do you determine the previous version of the endpoint software that was installed?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How do you determine the previous version of Cb Response sensor software that an endpoint sensor was running?

Environment

• Cb Response Sensor: All Supported Versions

Resolution

1. Review the sensor.log file.
2. Look for the version from a log entry that occurred before the upgrade.

Additional Information

• Windows sensor log file: %WINDIR%\CarbonBlack\Sensor.log 
• Linux sensor log file: /var/log/cbsensor
• There's no way to query the server or endpoint to determine what the previous version of the Cb Response sensor software was. The sensor.log file generally goes back only a couple of days, so if the upgrade occurred more recently than that, then the previous version may not be available to be known.