CB Response: How to Properly Terminate a Live Response Session

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To properly terminate a Live Response session and avoid unnecessary timeouts.

Environment

• CB Response Server: All versions

Resolution

While actively connected to a Live Response session:

1. To detach from a session but leave it active:

# detach

2. To fully end a session with the sensor:

# session close

 

Additional Information

• Sessions will timeout when they are not attached and active for five minutes.
• Restarting the cb-liveresponse service will terminate all active sessions.
• Each session has a unique numeric ID.
• Up to 10 sessions can be running at one time, and multiple users can be attached to the same session.