cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Access VMworld content on-demand if you missed the event. 70+ security focused sessions were offered -- access requires registration.

Carbon Black Cloud: Sensors Not Changing Policies After Upgrading to 3.6.0.1719

Carbon Black Cloud: Sensors Not Changing Policies After Upgrading to 3.6.0.1719

Environment

  • Carbon Black Cloud Sensor: 3.6.0.1719
  • Microsoft Windows: All Supported Versions

Symptoms

  • Sensor upgraded
  • After changing policies, error "policy assignment is pending and will be applied when device checks in with console" is shown
  • After multiple check-ins, policy is not changing

Cause

  • No connection to content.carbonblack.io
  • Interaction between new AMSI feature and non-EDR deployments.

Resolution

  1. Confirm connection to content.carbonblack.io is established
  2. For EDR (Formerly CB Threathunter) Customers:
    • If the alarm outlined in step 1 is present this indicates there is a network connection issue. Resolving the network issue will resolve this.
    • If the alarm outlined in step 1 is not present run the "repcli status" command
      Windows PSC Response Policy Revision[81]: Enabled (Datafile2)
      - If (Datafile2) is shown, please contact Carbon Black Support for assistance.
  3. For Non EDR Customers there are two workarounds:
    1. Delete registry key (See Additional Notes):
      1. Place machine into bypass mode
      2. Delete registry key HKLM\software\cbdefense\PscRuleCheck
      3. Disable bypass mode
      4. Request policy change again
    2. Reinstall the 3.6 sensor
An upcoming backend update and sensor release will also resolve this. The policy change will need to be requested again after the update as the first switch is being rejected.

Additional Notes

  • What is the risk of deleting the pscrulecheck registry key?
    • If the sensor has the Enterprise EDR (Formerly CB Threathunter) feature turned on and the sensor doesn't have manifest rules this is not a viable workaround.  The sensor will stop sending EDR events if it doesn't have the manifest rules and this key is deleted.
  • New installations of 3.6 are not effected by this, only upgrades.

Related Content


Was this article helpful? Yes No
100% helpful (2/2)
Article Information
Author:
Creation Date:
‎09-25-2020
Views:
118