Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How to check current dynamic Sensor Management Content Manifests (Linux)

Carbon Black Cloud: How to check current dynamic Sensor Management Content Manifests (Linux)

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard
    • Enterprise EDR
    • Audit & Remediation
    • Workload
  • Carbon Black Cloud Sensor: 2.12.x.x and Higher
  • Linux: All Supported Versions

Objective

Provide steps to check on the current revision of dynamic detection and prevention features (management content manifests) and the last date and time it was updated for a given Sensor.

Resolution

  1. Launch terminal emulator
  2. Check for current ruleset revision
    sudo grep -Ein --color "tarefreshpolicy.*revision\:" /var/opt/carbonblack/psc/log/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40/threat_hunter_log.txt
  3. Output will show versions/revisions in use
    <line>:[YYYY-MM-DD hh:mm:ss.ssssss]... ThMgr : TARefreshPolicy : Linux TH Ruleset Revision: <rev#>
    <line>:[YYYY-MM-DD hh:mm:ss.ssssss]... ThMgr : TARefreshPolicy : Linux Defense Ruleset Revision: <rev#>
    <line>:[YYYY-MM-DD hh:mm:ss.ssssss]... ThMgr : TARefreshPolicy : Linux HashBan Ruleset Revision: <rev#>
    

Additional Notes

  • Each ruleset revision will have a number if the Sensor is getting updated regularly
    Linux TH Ruleset Revision: <rev#>
    Linux Defense Ruleset Revision: <rev#>
    Linux HashBan Ruleset Revision: <rev#>
  • Organizations with Endpoint Standard or without Enterprise EDR will see Linux HashBan Ruleset Revision with a value of 0
    Linux HashBan Ruleset Revision: 0

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-14-2022
Views:
160
Contributors