Endpoint Standard: How To Create Groups Based on Domain/Hostname?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide guidance on creating Sensor Groups in the Carbon Black Cloud (CBC) Console

Environment

• Endpoint Standard (formerly CB Defense PSC) Console: All Versions
• Endpoint Standard Sensor: 3.1.x.x and Higher (Windows), 3.2.x.x and Higher (Mac)
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Mass Sensor Management (MSM), aka Sensor Groups

Resolution

1. Go to Endpoints
2. Click '+Add Group' button
3. Click 'Continue and create group' button on group creation pop-up
4. Enter a Group Name as desired
5. Select OS criteria

   Any, Windows, Mac

6. Set 'Sensors that meet... of these criteria will be added to this group' to 'all' or 'any' as desired
7. Set 'Select criteria' field

   Active Directory Organizational Unit
   Active Directory Domain
   Active Directory Distinguished Name
   Device Name
   Subnet

8. Set second drop-down as desired

   contains
   is equal to
   is not equal to
   starts with
   ends with

9. Enter desired text for matching
10. Add additional Criteria by clicking the Add icon (+) to the far-right of the line added in the above steps if desired
11. Select the Policy to assign to Sensors meeting the criteria of the Sensor Group
12. Click 'Save'
13. Click 'Add Group'

Additional Information

When creating MSM Groups for auto-assigning Sensors to Policies, it is important to remember the following

• Domain Name is case sensitive (use both uppercase and lowercase variations)
• Hostname/Device Name is case sensitive (use both uppercase and lowercase variations)
• Use a double backslash (\\) between Domain and Hostname (domain\\hostname)
• Add criteria in descending order of specificity (i.e., most specific to least specific) to avoid mix-ups
• Case sensitivity and the need for a double backslash will be resolved in future releases of the Endpoint Standard Web Console
• Ordering criteria is important to make sure shorter character strings are not errantly matched within longer strings
• The Active Directory Domain should match the Domain Name listed under the Distinguished Names of your devices

Examples

Domain, Hostname, and backslashes

• YOURDOMAIN\\HOSTNAME
• yourdomain\\hostname
• YOURDOMAIN\\hostname
• yourdomain\\HOSTNAME

Ordering Criteria

• YourDomain\\SECURITY
• YourDomain\\IT
  IT can be found in Security, so filter out the devices with Security in the name before those with just IT in the name