Access official resources from Carbon Black experts
Advanced Search
IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!
EDR: How To Isolate An Endpoint Running a CB Response Sensor
Environment
EDR: 5.x - 6.x
EDR: All Versions
Objective
How to isolate an endpoint running a CB Response sensor.
Resolution
In the navigation bar of the CB Response console, select Sensors.
On the Sensors page, check the box next to each endpoint to isolate.
From the Actions drop-down list, select Isolate.
In the confirmation dialog box, click OK to confirm isolation of these endpoints.
Additional Notes
User must be a Global Administrator to put any sensor into isolation.
The CB Response server can communicate with an isolated computer.
To allow the sensor to communicate with the CB Response server, ARP, DNS, and DHCP services remain operational on the sensor’s host.
DNS and DHCP are allowed through on all platforms during isolation. This is required for proper communications to the Cb Response server. Protocols are allowed by UDP/53, UDP/ 67, and UDP/68.
ICMP is allowed on Windows (operating systems prior to Vista) and OSX during isolation.
UDP is blocked on all platforms during isolation.
When an endpoint is designated for isolation, its status on the server first moves into in “isolation configured” state waiting for its next check-in. Because of this, there could be a period of several minutes before the endpoint is actually isolated. When it checks in, the server tells the sensor to isolate the endpoint, and when the sensor responds, its state changes to “isolated”.
Once isolated, endpoints normally remain isolated until the isolation is ended through the console. However, if an isolated system is rebooted, it is not isolated again until it checks in with the CB Response server, which again could take several minutes.
