Order of operations for how Endpoint Standard Sensors connect to cloud infrastructure if connection fails.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What is the order of operations for how the Carbon Black Cloud Sensor connects to the cloud infrastructure if it fails to connect?

Environment

• Carbon Black Cloud Sensor: All Versions

Resolution

The sensor will do the following steps to connect to the backend:

1. Statically configured proxy server from installation

2. Direct connection to cloud with no proxy

3. Direct connection to cloud using alternate port 54443 with no proxy

4. Dynamic proxy (Internet / Network settings) if present without credentials.

5. If no other way works and if a proxy is found and credentials are required, the sensor will try this as a last resort

6. LAST_ATTEMPT_PROXY_ SERVER

Additional Information

• For every proxy server connection tried in the steps above, the sensor will attempt to connect with:
  1. The proxy port that is configured
  2. Alternate port 54443; if this has been configured at install.
• The Carbon Black Cloud Sensor retries network discovery only if it fails talking to the cloud (back end infrastructure).  Once it has established a way to connect it does not retry until the next failure.
• The Sensor will try the last known good settings that worked previously; starting with the most recent ones.  This includes proxy, no proxy, credentials, no credentials, proxy used at install time, direct connection, alternate 54443 port.