Browse your product documentation including release notes and installers
Carbon Black is announcing General Availability of a new version of its market-leading incident response and threat-hunting solution, Cb Response 6.1. This release completely reinvents the back-end architecture and front-end UI of the product.
Cb Response now scales to the largest of enterprises, supporting 150,000 endpoints per cluster built on a new, innovative system architecture. Performance is markedly faster. Storage is also decoupled from processing. If you want to keep your data longer, just add disks, not servers. The improved scaling marks a 3X improvement over previous versions, something our team, our customers, and prospects around the world are very excited about.
On the front-end, the new UI streamlines workflows, improves ease of use and creates a better overall analyst experience.
The new release is available now. Please check for upgrade instructions.
***Update 5/25: Please check out the for known issues and knowledge base articles that have been generated since GA. These docs will help out as you get started with 6.1. Thanks!
**Note: There are two scenarios under which we recommend that you delay upgrade. See below for more details.
The following is an quick overview of the prominent features included in 6.1.
The release is now available now on YUM. Please check for details on how to install/upgrade and for new versions of product documentation.
As with all endpoint deployments, we highly recommend a phased roll-out approach in line with your organization’s software deployment best practices.
If you have any questions or concerns, please contact Cb Technical Support.
The Cb Response Team
This is great news and we're really excited about the release. We looked through the release notes and didn't see specifics around the Live Response and Isolation improvements.
Can you elaborate on the following please?
Quick question. If upgrading the CB server, would older versions of the sensor still be compatible if we didn't deploy them right away? Would there be any performance issues in using slightly older sensors?
Yes, 5.x sensors will be compatible with the 6.1 server. You will not see the full performance benefits without upgrading your sensors. I quote 3x in the post, with older sensors you'll be seeing somewhere in the 2x range.
Let me know if you have any add'l questions.
In 6.1, we made significant improvements in the sensor check-in and data ingest pipelines. This work resulted in communications coming to/from the sensors more often and more reliably. This has two benefits:
1) Because sensors are checking more frequently and on a more predictable cadence, isolation and CBLR will be more responsive (since these features rely on check in to take any action)
2) The new data ingest model means that (in a vast majority of cases) when data arrives at the server it is ingested and made searchable significantly faster than in 5.2.x.
Let me know if you'd like to discuss further. Appreciate the question!
Technical Product Manager - Cb Response
The delivery schedule for Unified View has been adjusted to August. This is partly due to the overall effort and partly to accommodate a few very important changes to how we package and deliver Unified View.
Any updates on the release of the new version of Unified View?
Due to a number of factors we are adjusting the schedule for release of Unified View 6.1. The new schedule is as follows:
September - Controlled Distribution (production ready)
October - GA
If you would like access to the Controlled Distribution, please email email@example.com.
We apologize for this delay and appreciate your patience. If you would like to discuss further, please feel free to reach out to me directly firstname.lastname@example.org.