Carbon Black Cloud: How to Customize the CBC Installer for Linux to Install Just LiveOps

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to create a LiveOps only installer package for Linux for a ThreatHunter/LiveOps organization

Environment

• Carbon Black Linux Sensor: 2.5.0 and Higher
• Linux: All Supported Versions

Resolution

1. Obtain the Agent Sensor Kit.
2. Unpack Agent into a temporary directory.
3. In the temporary install directory, remove the Threat Hunter blade by running:

rm -f blades/cb-psc-th-<BUILD-NUMBER>.tar.gz

5. Re-package the tar file: From the temporary install directory, use the command

tar -czvf cb-psc-sensor-rhel-<BUILD-NUMBER>-LO-only.tgz

The resulting tar file can then be used with the command line install or with a provisioning tool as per the regular installation instructions.  
 

Additional Information

Throughout these instructions, replace <BUILD-NUMBER> in the example commands with the appropriate version numbers of the packages downloaded from the console.