Endpoint Standard: How to use RepCLI to Confirm Sensor Policy Updates

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Use the RepCLI utility to confirm the last policy update received by a Sensor

Environment

• Endpoint Standard (formerly CB Defense) Sensor: 3.3.x.x and Higher
• Microsoft Windows: All Supported Versions

Resolution

1. Open a command prompt on the machine in question
2. Navigate to the Confer Directory

   cd C:\Program Files\Confer

3. Run the repcli status command (authentication is not required)

   repcli status

4. Scroll through the results to the Rules section and confirm the Policy name and Policy update time stamp

   Rules Status:
           Policy[Standard] Time[Month/Day/Year 00:00:00]

Additional Information

• Since the "repcli status" command does not require authentication, this can be run on any Sensor that includes the RepCLI utility (3.3.x.x and higher)
• The time stamp will denote the last time the policy rules were updated
• The policy name will reflect the latest policy group the sensor is assigned
• Earlier version of the sensor used the section name "Enforcement Status" instead of "Rules Status"