Carbon Black Cloud: How to Perform an Unattended Installation of the Windows Sensor

Carbon Black Cloud: How to Perform an Unattended Installation of the Windows Sensor

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All Versions
  • Microsoft Windows: All Supported Versions

Objective

Provide the information and steps to perform an unattended install

Resolution

  1. Download the desired sensor install kit
  2. Have the company registration code ready for the version you are installing
  3. Open an elevated command prompt and run the following command:
msiexec.exe  /qn /i CbDefense-setup.msi  /L*vx log.txt <CbDefense_msi_command_options>

Additional Notes

  • Please note that unattended installation and use of the company code requires the /q command line option. If you run it without this option, the installer will launch with the user interface and will ask for the 6 digit activation code which is used in the attended Windows install of the Carbon Black Cloud Sensor.


EXAMPLES

  • This is a basic unattended install:
msiexec /qn /i C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-64.msi /L*vx log.txt COMPANY_CODE=12345678
  • This is an unattended install that will put the sensor into a specific policy that has already been created in the console:
msiexec /qn /i C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-64.msi /L*vx log.txt COMPANY_CODE=12345678 GROUP_NAME=Phase1
  • This is an unattended install that will install the sensor and assign it to a previously created sensor policy and install the sensor in a bypassed state:
msiexec /qn /i "C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-64.msi" /L*vx log.txt COMPANY_CODE=12345678 GROUP_NAME=Phase1 BYPASS=1

Supported Command Options
  • Below is a list of the ONLY SUPPORTED command options. Any additional command options used and not listed here can cause the install to fail and will not be supported:
 
Command Options (case sensitive)ValuesNotes
AMSI=value1/0 or True/FalseDefault is true (enable AMSI) in Sensor 3.6 and above; turning off this feature will prevent Carbon Black Vmware AMSI DLL, cbamsi.dll, from loading into any instances of AMSI-registered processes (e.g. powershell) and thus sensor will not detect or block any AMSI activity
AUTO_CONFIG_MEM_DUMP=Value1/0

Default is 1, which, in sensors 3.5.0.1523 and above, will allow to generate a kernel space memory dump (and user space dump, if kernel debugging is enabled) from a LiveResponse session.  For information on enabling kernel debugging please refer to Microsoft's documentation.

Starting with the 3.5.0.1680 sensor, the parameter AUTO_CONFIG_MEM_DUMP=0 allows administrators to opt-out of the user/kernel memory dump configuration when disk storage is limited, as the page file will take up the same space as the size of the installed RAM.

If a full memory dump is required, follow the instructions here, please note a reboot will be required.

AUTO_UPDATE=value       1/0 or True/FalseDefault is true (enable auto update); turning this off will prevent the update from being pushed from the backend.
BACKGROUND_SCAN=value1/0 or True/FalseDefault is true.
BASE_IMAGE=value1/0 or True/FalseDefault is false; the installed image is a base image that can be cloned to child images. This option is not supported for VDI.
BYPASS=value1/0 or True/FalseDefault is false; setting it to true will enable bypass mode. In bypass mode the sensor does not send any data to the cloud; it functions in a passive manner and does not interfere with or monitor the applications on the endpoint. Install the sensor in bypass mode to test for interoperability issues.
CLI_USERS=sidSID value for authenticated user or groupUse this field to enable the RepCLI tool. Any member in a specified user group can use the authenticated RepCLI commands. This field currently accepts only one SID value.
COMPANY_CODE=value8-character code for 1.x and 2.x sensor version or Longer code for 3.x sensor version

If a special character is included, the Company Code should be enclosed in double-quotes

COMPANY_CODE="<Company#Code>"

Required for command line installations. Navigate to Endpoints > Sensor Options > Company Codes to access or create a new Company Code. 

CONNECT_LIMIT=valueNumber of connections per hourOptional; default is no limit.
CURL_CRL_CHECK=value1/0 or True/False

This options is available in 3.4.0.925 and higher Sensors only and can be used to disable the CRL check introduced with the 3.3.x.x Sensor.  This option is covered in depth here

DELAY_SIG_DOWNLOAD=value1/0Default is delay signature/ definition download. We recommend that you do not change the default value.
CBLR_KILL=value1/0A value of 1 disables Live Response functionality for the sensor. The default value is 0.
FILE_UPLOAD_LIMIT=value4-byte integer representing number of megabytesExample: value of 3 is a limit of 3*1024*1024 bytes; default value is 5.
GROUP_NAME=valueString valueOptional policy name assignment. Enclose this value with double quotes if the policy name includes spaces.
HIDE_COMMAND_LINES=value1/0Obfuscates command line inputs. Default is 0.
LAST_ATTEMPT_PROXY_ SERVER=valueValue example: 10.101.100.99:8080Optional. Sensor will attempt cloud access by using this setting when all other methods fail (including dynamic proxy detection).
LEARNING_MODE=valueValue is the number of hours after sensor install to limit event types. This is a mechanism for reducing the load on the backend by dropping some report types after initial install. Generally, more reports are sent to the backend soon after sensor install because the sensor reports on newly detected hashes. Learning mode reports only on file and process behavior while the sensor is detecting hashes. Reporting of API, registry, and network behavior is dropped during this period.Optional; default is disabled.
 
OFFLINE_INSTALL=value1/0
Allows Sensor to be installed without a connection to the backend.  Sensor will download policy and register with the backend when a connection is established
This option is available in 3.5.x.x and higher Sensor only.  The command is optional; default is disabled.
PROXY_PASSWD=valueProxy passwordOptional
PROXY_SERVER=valueserver:portOptional
PROXY_USER=valueProxy usernameOptional
QUEUE_SIZE=valueEvent backlog in MBOptional; default is 100MB; this value does not include SSL overhead.
RATE_LIMIT=valueKB per hourOptional; default is No Limit.
VDI=value1/0 or true/falseDefault is false. VDI=1 has been deprecated on Sensor versions 3.3.x.x and higher in favor of RepCLI command options as noted here
USER_EMAIL=valueEmail address Example: user@example.comOptional

Related Content


Was this article helpful? Yes No
100% helpful (3/3)
Article Information
Author:
Creation Date:
‎08-24-2020
Views:
25949
Contributors