Does the Carbon Black Cloud sensor support proxy server authentication?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does the Carbon Black Cloud sensor support proxy server authentication?

Environment

• Endpoint Standard Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

Yes, proxy server authentication is supported with Windows and Mac sensors. Typically end users will not be required to enter their credentials for proxy authentication because the sensor will attempt to auto-detect the pre-existing proxy server and proxy credential configuration from the local system operating system (when applicable). However, this should be tested prior to sensor deployment.

 

Additional Information

• If the automatic proxy detection doesn’t succeed, first specify server and port with the following command (authentication can be added as needed)

(Windows Sensor): PROXY_SERVER=<server>:<port>, PROXY_USER=<username>, and PROXY_PASSWD=<password>

or

(MAC Sensor): -p <server>:<port> -x <username>:<password>

• Optionally, also specify the following option

LAST_ATTEMPT_PROXY_SERVER=<server>:<port>

• Using this option, the sensor will attempt cloud access using this setting when all other methods fail (including dynamic proxy detection). See our documentation for more details on the above options. 
• Replace <server>:<port> , <username>, <password> with the actual server/IP and port of the proxy server as well as the actual username and password required by the proxy server for authentication. Example:

PROXY_SERVER=10.10.10.1:8000 PROXY_USER=user01 PROXY_PASSWD=P*ssw0rd

• To bypass the network proxy or firewall completely, configure the proxy server or firewall to allow outgoing connections from the sensor to the Carbon Black Cloud Console. See this KB for more details.