Endpoint Standard: How to verify AV Signatures are updating

[#1]

Environment

• Carbon Black Cloud (formerly PSC) Console: All Versions
  • Endpoint Standard (formerly CB Defense) sensor: 2.0 and higher
• Microsoft Windows: All Supported Versions
• Local Scan and Signature Updates enabled

Objective

Provide steps to verify Local Scanner Virus Definition files (VDF) are updating on Endpoint Standard Sensor

Resolution

Via Endpoints page

1. Go to the Endpoints page in the CBC Console
2. Search for the desired Device Name
3. Expand the Device Details
4. Check 'Scan Engine' field for VDF version; Example: 

   Scan Engine: 4.11.0.307-ave.8.3.54.68:avpack.8.5.0.12:vdf.8.16.19.110:apc.2.10.0.110

5. Check the published date for the VDF version listed: https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-To-Determine-Latest-VDF-Ve...

NOTE: If signatures are up to date, the "SIG" column on the Endpoint page will display a green circle for the endpoint.

Live Response (LR) with RepCLI enabled

1. Go to the Endpoints page
2. Search for the desired Device Name
3. Click on the Live Response icon ('>_') to initiate LR session
4. Change directory to the Confer folder

   cd C:\Program Files\Confer

5. Run command to get current Sensor status

   repcli status

6. Check 'Local Scanner' line for VDF version; Example: 

   Local Scanner Version[4.11.0.307 - ave.8.3.54.68:avpack.8.5.0.12:vdf.8.16.19.110:apc.2.10.0.110]

7. Check the published date for the VDF version listed: https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-To-Determine-Latest-VDF-Ve...

Locally on endpoint using cmd.exe

1. Connect to the desired device
2. Launch cmd.exe
3. Run the following commands:

In 3.5 an earlier sensor versions:

type "c:\Program Files\Confer\scanner\upd.log" | find "\aevdf.dat" | find "!="

In 3.6 and later sensor versions:

type "C:\ProgramData\CarbonBlack\Logs\upd.log" | find "\aevdf.dat" | find "!="

4. Copy the highest VDF version (last entry returned); Example:

   Callback: C:\Program Files\Confer\scanner\...\aevdf.dat 8.16.19.108 != 8.16.19.110

5. Check the published date for the VDF version listed: https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-To-Determine-Latest-VDF-Ve...

Related Content

Endpoint Standard: Troubleshooting AV Signature Pack Updates From The Console
Carbon Black Cloud: How to Get Started With RepCLI
Endpoint Standard: How to Configure Sensors to use HTTPS for Signature Updates
Endpoint Standard: How To Determine Latest VDF Version and Date Via Developer Tools