Stop and Start the Carbon Black Cloud Sensor via Command Line / Terminal

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to completely stop/start the Carbon Black Cloud Sensor for testing purposes.

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions
• Linux: All Supported Versions

Resolution

Windows

To stop / disable the sensor

1. Log into the machine with a user account that matches the AD User or Group SID configured for RepCLI authentication.
   • How to Enable RepCLI Authentication on Existing Sensors
2. Launch a Command Prompt.
3. Change directory to C:\Program Files\Confer. 

   cd C:\Program Files\Confer

4. Bypass must be enabled on the Sensor before services can be stopped.

   repcli bypass 1
   Sensor is in bypass mode

5. Stop Sensor services.

   repcli stopcbservices
   Successfully sent command to stop the service via RepUtilStopService
   

To start / enable the sensor

1. From an administrative Command Prompt, execute the following commands.

   net start cbdefense
   The CB Defense service was started successfully.
   

2. Change directory to C:\Program Files\Confer. 

   cd C:\Program Files\Confer

3. Remove the Sensor from Bypass

   repcli bypass 0
   Sensor is fully enabledrepcli bypass 0
   Sensor is fully enabled

Linux

To stop / disable the sensor

• For distributions using SystemD (e.g. CentOS 7), run the Terminal command below.

  sudo systemctl stop cbagentd

• For older distributions using SystemV (e.g. CentOS 6), run the Terminal command below.

  sudo service cbagentd stop

To start / enable the sensor

• For distributions using SystemD (e.g. CentOS 7), run the Terminal command below.

  sudo systemctl start cbagentd

• For older distributions using SystemV (e.g. CentOS 6), run the Terminal command below.

  sudo service cbagentd start

Additional Information

• Sensor Bypass can be toggled with RepCLI or through the Console while the services are running.
• Sensor services cannot be started with the RepCLI utility, but can be started via services.msc or elevated Command Prompt (e.g. net start, sc start, etc.).