Collect Carbon Black Cloud Sensor Logs Using Live Response
book
Article ID: 290010
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)Carbon Black Cloud WorkloadCarbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
Issue/Introduction
Collect Sensor Logs for a remote machine via Live Response
Environment
Carbon Black Cloud Sensor: All Supported Versions
Microsoft Windows: All Supported Versions
Linux: All Supported Versions
macOS: All Supported Versions
Resolution
Note: Ensure the Sensor you require logs from is online, checking in and in a policy that has Live Response enabled
Windows
Login to the Console
Go to the Endpoints Page
Click on the 'Go Live' icon (>_) to enable a Live Response session
Change Directory to the Sensor's Directory
cd C:\Program Files\Confer
Run the command:
execfg repcli capture c:\temp -- Change to desired writeable location
You will receive immediate confirmation that the logs are being collected 'collecting diagnostic data (this may take a few minutes)', followed by confirmation that the logs have been captured 'Captured diagnostic data in written to c:\temp\psc_sensor.zip
Run the following command to retrieve and download the captured Sensor Logs to your local machine
get c:\temp\psc_sensor.zip -- Change to location specified in previous command
This file will download to whichever directory you have specified to download to (usually 'Downloads')
Linux
Login to the Console
Go to the Endpoints Page
Click on the 'Go Live' icon (>_) to enable a Live Response session
Run the following command to retrieve and download the captured Sensor Logs to your local machine:
get <Destination_Directory>/confer.zip
This file will download to whichever directory you have specified to download to (usually 'Downloads')
Additional Information
If the file does not automatically download, this may be due to your Browser settings, in which case, the file link on the LR screen 'File ready for download' can be clicked, at which point it will either download automatically, or ask where to be saved (again, depending on Web Browser settings)