EDR: Will Multiple Sensors Upload Same Binary

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is there a situation where multiple Sensors will upload the same binary, e.g, patching ?

Environment

• EDR Server: All Versions
• EDR Sensor: All Versions
• CB Cluster

Resolution

Yes. In a CB Cluster environment this issue may occur when Sensors are uploading to different Secondary servers. This is due to a timing/race condition when the CB Cluster is aware of the binary to upload.  

Additional Information

• The first client to report the binary will get a request to upload the file
• Other endpoints will also receive requests to upload the binary until the binary is received from one
• There have been no issues raised related to this. Essentially this is a race to upload the binary as soon as the update occurs