How to Migrate To A New Carbon Black EDR Server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to migrate all data and configs to a new EDR server. 

Environment

• Carbon Black EDR Server: All Supported Versions

Resolution

1. Follow the backup and restore guide to backup the configs and data. Backup and Restore
2. Follow the instructions to install the rpm, do not continue to cbinit yet. Server Installation
3. Copy over the /etc/cb/certs from the old server to the new server.
4. Run cbinit and continue through the prompts, select yes to reuse the certificates in order for sensors to connect during migration.
5. After cbinit completes, restore the remaining backup items to the new server. 
6. If hostname or IP has changed, please follow this article. 
   • Change Server IP or Domain Name Address (Single Node)
   • How to Change Server IP Addresses for a Cluster (Multi-Node)
7. Start the services. 
8. Migrate the sensors from the old server to the new server. How to Migrate Sensors to a Different EDR Server on 6.4.0 or Higher

Additional Information

• This guide assumes all data is being moved over
  • /var/cb/data/postgres: user data, watchlists, sensor ids, settings
  • /var/cb/data/solr:
    • cbmodules contains binary search page info
    • cbevents contains all searchable events
    • cbalerts contains all triage alerts
    • cbfeeds includes all threat intel feed information
  • /var/cb/data/modulestore: contains all physical binaries that are downloadable from the console.