EDR: What changes are implemented on the Linux machine after sensor installation?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What changes are implemented on the Linux machine after sensor installation?

Environment

• EDR(Formerly Carbon Black Response) Sensor: All Supported Versions

Resolution

• The sensor has its own configuration files but does not modify any system level settings or libraries.
• The sensor daemon has privileges and there is a kernel module that "hooks" into some system calls or a eBPF module that uses APIs to capture data.
• The sensor may install some kernel packages that we need to capture events on some Operating Systems.