Carbon Black Cloud: How To Verify Hash for Sensor Version

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide steps for checking the hash of all Sensor versions available on the Endpoints page using Developer Tools (DevTools)

Environment

• Carbon Black Cloud Console: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions

Resolution

Chrome

1. Log into the CBC Console
2. Open DevTools (F12) and select the Network tab
3. Go to the Endpoints page
4. Find the 'published' item in DevTools
5. Select the Preview sub-tab
6. Find and expand the desired OS item (AMAZON_LINUX, AV_SIG, MAC, RHEL, SUSE, UBUNTU, WINDOWS)
7. Expand desired Sensor build item and sub-items (0, 1)
8. The 'hash' item contains the SHA256 hash for that Sensor version

FireFox

1. Log into the CBC Console
2. Open DevTools (F12) and select the Network tab
3. Go to the Endpoints page
4. Find the 'published' item in DevTools
5. Select the Response sub-tab (sub-items for OS and Sensor build are expanded by default)
6. Find the desired OS and Sensor build item
7. The 'hash' item contains the SHA256 hash for that Sensor version

Safari

1. Log into the CBC Console
2. Open Web Inspector (⌥⌘I) and select the Network tab
3. Go to the Endpoints page
4. Find the 'published' item in Web Inspector
5. Select the Preview sub-tab (sub-items for OS and Sensor build are expanded by default)
6. Find the desired OS and Sensor build item
7. The 'hash' item contains the SHA256 hash for that Sensor version

Additional Information

• This can be a quick way to verify the hash of a Sensor version once it has been downloaded in order to verify the file has not been tampered with or modified
• As with any hash, renaming the file will have no impact on the hash, only substantive modifications of the contents of the file would change the SHA256