Carbon Black Cloud: How To Find DeviceID In Sensor Logs (Linux)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

 To find the DeviceID from sensor logs provided by the customer per the instructions in Carbon Black Cloud: How To Find DeviceID In Sensor Logs (Linux)

 

Environment

• Carbon Black Cloud Sensor: All Versions
• Linux: All Supported Versions

Resolution

1. Launch terminal
2. Use grep to get RegistrationId

   % sudo grep 'RegistrationId' \var\opt\carbonblack\psc\cfg.ini

3. Look for "RegistrationId="

   RegistrationId=<org_id>-<device_id>
   
   Example:
   RegistrationId=4xxxx-3xx6xx

Additional Information

In the example above 4xxxx is the OrgID and 3xx6xx is the DeviceId