Change Server IP or Domain Name Address (Single Node)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Change the IP address or Domain Name of a Single Node EDR Server.

Environment

• EDR Server: All Supported Versions

Resolution

1. Change the Sensor Group URL
   1. Open the WebUI, then navigate to Administration > Sensors and select Edit Settings
   2. Change the Server Address to the new Address while keeping the same port number
   3. Repeat Step b for each sensor group if they exist
   4. Allow at least 10 minutes for online sensors to pick up the URL change
2. Update the IP address of the server from the EDR Server UI by going to Settings > Server Nodes   
3. Check /etc/cb/cluster.conf to confirm the host= matches the new IP if it's not listed as localhost
4. Update Remaining Sensors. Any clients that did not check-in before the server address is changed will need to modify the SensorBackendServer setting.
5. For Windows this is located at HKLM\SOFTWARE\CarbonBlack\config\SensorBackendServer
6. For MacOs and Linux, this value is stored in /var/lib/cb/sensorsettings.ini

 

Additional Information

• A 10 minute to 1 day delay after changing this setting in step one is recommended. All endpoints need to check in first to pull down the new server Address. Any offline endpoints that don't check in will either need to have sensor reinstalled or registry edited to point to the new server. 
• Warning: Verify the chosen settings sensor checkin url and port. A sensor will check in with the old information that the server is currently on and update that information locally (in the registry for windows). The next time the sensor tries to check in, it will be to the new server url and port. No other attempts will be made to connect to the old address. This means that if you update this information incorrectly, this will need to be updated by changing the server to that address, or performing Step 3 for all sensors. Changing the group setting in the UI back will only work for sensors had not checked in yet, all others will not get that setting reverted back automatically.