Endpoint Standard: How to prepare for May 27 Signature Pack update
book
Article ID: 291027
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
On May 27, 2020, a signature update will be released which will result in a one-time download of 40-50MB per endpoint. This article describes how to prepare for this update for organizations where there are network bandwidth concerns.
Environment
Carbon Black Cloud (CB Cloud) Console: All Versions
Endpoint Standard (formerly CB Defense)
Carbon Black Cloud Sensor: 2.0.1.x and Higher
Microsoft Windows: All Supported Versions
Automatic Signature Updates are Enabled in Policy settings
Local Mirror Server not used in Policy settings
Weak or unstable internet connections for endpoints
Resolution
Apply one of the following two Solutions:
A.) Configure a Local Mirror Server no later than 26-May-2020 https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-Getting-Started-with-Local-Mirror-Servers/ta-p/33594
B.) Disable Automatic Updates and deploy Standalone Signature Pack to prepare for incremental updates WARNING: Do not deploy the updated Standalone Signature Pack installer without disabling Automatic Signature Updates (prior to 28-May-2020) as this will result in full download upon switching to new signature format on 27-May-2020 defeating the purpose of the solution.
This Signature Update mentioned in this article reduces memory utilization and improves overall performance of the Local Scanner component of the CB Cloud Windows Sensor
By default, Automatic Signature Updates are downloaded over the internet by each Sensor, utilizing a Local Mirror Server shifts the external (internet) download to this server, and all Sensors in the designated Policy then download those updates across the local network (intranet)
If the Last Check-In date/time on the Endpoints page for a given device is more than 10-15 minutes old, there are likely communications issues with that device, which should be investigated on their own and not considered an issue with the standalone installer
Running `repcli status` before and after running the standalone installer is one of the simplest ways to double-check that it ran successfully by comparing the ave and vdf versions
The next time the Sensor is set to check into the Console can also be found via `repcli status`, after which you can refresh the Endpoints page to verify it has updated successfully
Example
C:\> "C:\Program Files\Confer\RepCLI.exe" status | findstr "Version Next"
Sensor Version[3.4.0.1097...]
Local Scanner Version[4.11.0.307 - ave.8.3.60.14:avpack.8.5.0.48:vdf.8.18.0.154:apc.2.10.0.110]
Next Check-In[1 min 26 sec]
Once the standalone installer has been applied and the Console has received the updated information, the Sensor will show out-of-date (red-triangle) in the Sig column since the version reported is not present on the update server (http[s]://updates2.cdc.carbonblack.io/updates2), and will remain showing this way until Automatic Signature Updates are reenabled and the Sensors pull down updated signatures from the server
Apc and Api values change but ave.8.3.60.14:avpack.8.5.0.48:vdf.8.18.0.154: are static when the signature updates are disabled in the policy. These values verify that the signature pack has been installed
The vdf files in data_1 and Data_2 from the signature pack install will be dated Monday, May 04, 2020.