Getting Started With Bypass Mode

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Container
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload

Issue/Introduction

How to Utilize Bypass Mode

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Resolution

Sensor Bypass

Disables all policy rule enforcement, device is not actively protected

• When should a device be placed in Bypass?
• How to Enable\Disable Bypass from the Web Console?
• How to Enable\Disable Bypass from the Sensor UI
• Enable/Disable Sensor Bypass on Sensors using Command Line (Windows)
• How to Toggle Sensor Bypass with the RepCLI Utility (Windows)
• How to verify Bypass Mode from the Console
• What Happens When Bypass has been Enabled on the device?
• Can Sensors be Upgraded While in Bypass?
• What are the Sensor Bypass Reasons and Remediation Options?

Application Bypass

Disables policy enforcement only on the specified application paths

• What Is The Difference Between Allow, Allow & Log and Bypass?
• What are the differences between API Bypass and Full Bypass

Additional Information

Sensor UI Taskbar Icon Meanings in Windows

Pre 3.5	Post 3.5	Sensor Mode
		Active
		Bypass
		Quarantine

MacOS Sensor UI

• Active will have a white Icon in Menubar
• Bypass will have a white Icon with red x in the Menubar
• Quarantine will make no changes in the icon. Sensor will have a white Icon in the Menu bar and the following message will be displayed: "Device has been quarantined by your computer administrator."