EDR: Is it Possible to Prevent the Uninstall of the Sensor?

[#1]

Environment

• EDR (formerly CB Response): 6.x and Higher
• App Control (formerly CB Protection) Agent: 7.2 and Higher
• App Control Server: 8.x and Higher

Question

Is it possible to prevent the uninstall of the Sensor? 

Answer

At this time there is no native feature in EDR itself to prevent the uninstall or require a password

Additional Notes

• App Control has the Rapid Config "CB Response Tamper Protection" which can be setup to prevent the uninstall of the Sensor but it won't prevent the service from being stopped
• EDR itself only has Tamper Detection on Windows

Related Content

CB Response: How to uninstall a corrupt Cb Response sensor
CB Response: Silently Uninstall Sensor on a Windows Machine
CB Response: How to uninstall a Sensor via cmd line when cbsetup.msi was used for installation
CB Response: Will uninstalled sensor records stay in the UI forever?
CB Response: Is it Possible to Prevent the Uninstall of the Sensor?
CB Response: Installed sensor is showing as uninstalled
CB Response: How to Bulk Uninstall Sensors
CB Response Sensor: How to manually uninstall a sensor from a Linux endpoint

To see this feature added please upvote the following:
cb response sensor uninstall feature
Password Protect Uninstall