CB Defense: How to Copy Scanner Files for Review

[#1]

Environment

• CB Defense Sensor: 2.0.x.x and Higher
• Microsoft Windows: All Supported Versions

Objective

Explain the steps to collect the scanner folder for review (C:\Program Files\Confer\scanner)

Resolution

1. Place the sensor into Bypass
2. Run `net stop cbdefense` from an elevated command prompt
3. Zip the contents of the "C:\Program Files\Confer\scanner" folder
4. Delete the scanhost.log file
5. Run `net start cbdefense` from an elevated command prompt
6. Bring the sensor out of Bypass

Additional Notes

• In most circumstances the entire contents of the Confer folder will be retrieved when pulling Sensor logs
• The above steps should only be required when the resulting logs do not include the scanner folder

Related Content

Carbon Black Cloud: How To Collect Sensor Logs Locally (Windows)