Carbon Black Cloud: How to Get Started With Bypass Mode

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Objective

How to Utilize Bypass Mode

Resolution

Sensor Bypass

Disables all policy rule enforcement, device is not actively protected

• CB Defense: When should a device be placed in Bypass?
• Carbon Black Cloud: How to Enable\Disable Bypass from the Web Console?
• Carbon Black Cloud: How to Enable\Disable Bypass from the Sensor UI
• Carbon Black Cloud: How to Enable/Disable Sensor Bypass on Sensors using Command Line (Windows)
• Carbon Black Cloud: How to Toggle Sensor Bypass with the RepCLI Utility (Windows)
• Carbon Black Cloud: How to verify Bypass Mode from the Console
• Carbon Black Cloud: What Happens When Bypass has been Enabled on the device?
• Carbon Black Cloud: Can Sensors be Upgraded While in Bypass?
• Carbon Black Cloud: What are the Sensor Bypass Reasons and Remediation Options?

Application Bypass

Disables policy enforcement only on the specified application paths

• Endpoint Standard: What Is The Difference Between Allow, Allow & Log and Bypass?
• https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-What-are-the-differences-between-API-...

Additional Notes

Sensor UI Taskbar Icon Meanings in Windows

Pre 3.5	Post 3.5	Sensor Mode
		Active
		Bypass
		Quarantine

MacOS Sensor UI

• Active will have a white Icon in Menubar
• Bypass will have a white Icon with red x in the Menubar
• Quarantine will make no changes in the icon. Sensor will have a white Icon in the Menu bar and the following message will be displayed: "Device has been quarantined by your computer administrator."

Related Content

Endpoint Standard: Mac Sensor installs with status "Sensor Bypass Admin Action"
Carbon Black Cloud: Unable to Disable Bypass on MacOS
Carbon Black Cloud: How to Perform an Unattended Installation of the Windows Sensor
CB Defense: Unable to toggle protection on via sensor UI if bypass enabled from back-end