How to install the required Linux Kernel Headers for Linux sensor 2.10.x and higher?

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How do I install the required Linux Kernel Headers for Linux sensor 2.10.x and higher?

Environment

• Carbon Black Cloud Linux sensor: 2.10.x and higher
• Linux: Kernel 4.4 and higher

Resolution

Instructions can be found in the Linux Installation Guide 

Additional Information

• Prior to installing the sensor, the underlying BPF implementation requires the Linux 4.4 kernel headers for the active kernel to be installed.  However, some lower kernels are still supported without BPF integration, for the full list, please see Linux Sensor Support.
• Kernel headers are required for both Endpoint Standard and Enterprise EDR functionality
• Kernel headers must remain present after install
• Should the kernel be updated, the kernel headers should be updated as well
• In cases where kernel headers cannot be found via public repo the install command will fail, and the headers may have been removed by the vendor.  Consider updating the kernel or finding an alternative source of the kernel headers for manual installation.