Carbon Black Cloud: How to Obfuscate Command Line Inputs

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• To obfuscate command line inputs in Carbon Black Cloud Sensor Logs for privacy reasons

Environment

• Carbon Black Cloud Sensor 3.4 and above
• Microsoft Windows: All Versions
• Apple MacOS: All Versions

Resolution

• One of the following 3 options can be used to obfuscate command lines:
  1. Use the HIDE_COMMAND_LINES=1 switch when doing an unattended install of the sensor
  2. Use RepCLI Command hideCmdLines [0|1] = 1 turns on the option, 0 turns it off
  3. Open the cfg.ini file in the confer directory and manually set HideCommandLines=true

Additional Information

• This is a feature of the sensor 3.4 and above only.
• These features will not work in older versions of the sensor. 
• This will only obfuscate command line inputs in logs stored on the device, and not in the console.