Methods to Install a Carbon Black Cloud Sensor

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Audit and Remediation Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops) Carbon Black Cloud Container Carbon Black Cloud Endpoint Standard Carbon Black Cloud Enterprise EDR Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter) Carbon Black Cloud Managed Detection (formerly Cb Threatsight) Carbon Black Cloud Managed Detection and Response Carbon Black Cloud Managed Threat Hunting Carbon Black Cloud Prevention Carbon Black Cloud Workload

Issue/Introduction

Steps to install a Carbon Black Cloud sensor

Environment

Carbon Black Cloud Console: All Versions
Carbon Black Cloud Sensor: 3.8.x and Higher
Microsoft Windows: All Supported Versions
macOS: All Supported Versions
Linux: All Supported Versions

Resolution

Prerequisites

Download the Sensor Kit.
Obtain the Company Registration Code
For Windows - determine which SID should be used for repcli authentication.
- Manage Windows Sensors by using RepCLI

Windows

Method 1: Manually Via an Installation Request (Attended Installation)

Note:

This method does not support adding an authenticated repcli user (or any installation customization). If installed this way, additional steps will need to be performed at a later date, should an authenticated user be needed.
One email Activation Code can be used for multiple devices but the code is only valid for 7 days from sending
Reusing the email's Activation Code will set the email address for the User field in Endpoints for who performed the installation
Emails and the Activation Codes cannot be revoked or cancelled once sent
The Audit Log will show who was sent the Activation Code if review of this is needed

Log into your Carbon Black Cloud Console
Go to the Endpoints page
Select Sensor Options menu
Select Send installation request
Enter the desired email for the user you are adding (use a comma to separate multiple emails if adding multiple users)
On the Device, open the email sent by [email protected]
Use the link included to download the installer if not already downloaded from another source
Run the installer
Enter the Activation Code (from the email) or the Company Registration Code.
Click Next through the Prompts to complete the Installation

Method 2: Manually Via CMD (Unattended Installation)

Reference the Installation Guide for Windows

Open and admin CMD Prompt and run the relevant command. Example:

msiexec /q /i "C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-32-3.3.0.953.msi" /L*v log.txt COMPANY_CODE=EnterCompanyCodeHere CLI_USER=EnterSidHere

Method 3: Offline Installations

Note:

This option should be used on machines when deployments must occur without any network connection
The Sensor will not apply policy or register with the backend until a connection is established
This command is not meant for air-gapped environments as the Sensor will not enforce policy rules without a connection to the backend

Open and admin CMD Prompt and run the relevant command. Include the command line option OFFLINE_INSTALL=1 when deploying the sensor

msiexec /q /i "C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-32-3.3.0.953.msi" /L*v log.txt COMPANY_CODE=EnterCompanyCodeHere CLI_USER=EnterSidHere OFFLINE_INSTALL=1

Ensure the Sensor is able to reach the backend as soon as possible to allow for policy download and registration with the backend

macOS

Note:

For the macOS sensor to be fully functional, the System and Extension and Network Extension must be approved. See Approving the System Extension and Network Extension for macOS 11+

Method 1: Manually Via an Installation Request (Attended Installation)

Note:

One email Activation Code can be used for multiple devices but the code is only valid for 7 days from sending
Reusing the email's Activation Code will set the email address for the User field in Endpoints for who performed the installation
Emails and the Activation Codes cannot be revoked or cancelled once sent
The Audit Log will show who was sent the Activation Code if review of this is needed

Log into your Carbon Black Cloud Console
Go to the Endpoints page
Select Sensor Options menu
Select Send installation request
Enter the desired email for the user you are adding (use a comma to separate multiple emails if adding multiple users)
On the Device, open the email sent by [email protected]
Use the link included to download the installer if not already downloaded from another source
Run the installer
Enter the Activation Code (from the email) or the Company Registration Code.
Click Next through the Prompts to complete the Installation