CB Response 6.3.0 Server Configuration (cb.conf) Guide

[#1]

Note:  This document applies to Cb Response versions 6.3.0 and 6.3.1.

This document describes the contents of the cb.conf file, the primary configuration file for CB Response. By changing the values of parameters in cb.conf, you can change the behavior and performance of CB Response.

Before editing the cb.conf file, you should be sufficiently familiar with the features and operation of CB Response to decide about when and whether to change its configuration. For details about using CB Response, refer to the CB Response User Guide.

See the Comments section below for a brief summary of changes to this document since the previous edition.

[triordan]

Additional changes for the April 2019 CB  Response 6.3.0 Server Configuration (cb.conf) Guide:

1. Corrected the default value of CbFileDescriptorLimit, which was incorrect in previous versions of this document. The correct default is 80000.
2. Corrected the default value of CBLREnabled and added additional descriptive text. The default value of CBLREnabled changed for version 6.3.0. It was previously False. There is now no default value, which means that on newly installed servers, a checkbox for enabling and disabling Live Response will be active on the Advanced Settings page unless cb.conf is modified.

Change log for the March 2019 Cb Response 6.3.0 Server Configuration (cb.conf) Guide (changes since the most recent 6.2.4 guide):

1. Added ShowGdprBanner, a which controls a new feature that allows a special banner to be displayed at the top of each console page to warn users to take extra caution in sharing data.

2. Added EnableProcessSHA256FeedHitEvents, which controls whether ingress and subsequent storage feed hits triggered by the SHA-256 of the process are enabled.

3. Modified the description of CbLREnabled to indicate that if this setting is commented out or has no value in cb.conf, an administrator can enable or disable Live Response via a checkbox on the Advanced Settings page in the console.

4. Modified the change notes for CoreServicesProcessSearchPageSize and CoreServicesBinarySearchPageSize to indicate that these settings function as described in release 6.3.0 and later, but had no effect in previous releases.