Endpoint Standard: How to Force Sensor to Check Into Console With RepCLI

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Force the Sensor to check in with the Web Console utilizing various RepCLI Cloud Commands

Environment

• Carbon Black Cloud Web Console: All Supported Versions
• Endpoint Standard Sensor: 3.3.x.x and Higher
• Microsoft Windows: All Supported Versions

Resolution

1. Log into the machine with a user account that matches the AD User or Group SID configured at the time of sensor install.
2. Launch a Command Prompt.
3. Change directory to C:\Program Files\Confer

   cd C:\Program Files\Confer

4. Enter the following command. If successful, "Successfully scheduled request" will print to the command line

   repcli cloud hello
   

5. The following table includes all repcli cloud command options and their expected results

   RepCLI Cloud Option (not case sensitive)	Result
   hello	Sensor to checks in with the Web Console
   QueryConfig	Sensor checks for update to Policy configuration settings
   QueryRules	Sensor downloads and updates Policy rules
   Metadata	Sensor sends updated system information to the Web Console
   Zip	Sensor downloads a zipped file containing both Configuration setting and Policy rules and applies new settings
   UninstallCode	Sensor checks for an update to the Uninstall Code
   RepConfig	Sensor downloads and applies Whitelist/Blacklist configuration including IT Tools and Cert Whitelisting
   SensorState	Uploads sensor active state to Web Console
   Alarms	Uploads any Sensor alarms to Web Console
   DeviceInfo	Uploads Sensor name and SID to Web Console
   PscReport	Uploads Cb ThreatHunter messages
   UbsQuery	Checks for files that Web Console has requested from Sensor
   UbsUpload	Begins upload of any requested files

Additional Information

• The command options in the table are not case sensitive and only include capital letters for readability
• All of the above commands options should be preceeded by "repcli cloud" in the command string
• Active Directory-based SID authentication is required to run the "repcli cloud" commands
• While the "repcli cloud" commands will often complete immediately, there may be other queued tasks that will complete first
• The printed response in the command line of "Successfully scheduled request" reflects the fact that tasks are queued