Environment
- Carbon Black Cloud: 14 April 2022 Release and Above
- Linux: All Supported Versions
- MacOS: All Supported Versions
- Microsoft Windows: All Supported Versions
Question
What are the reasons a device goes into bypass mode, and what can be done to correct it?
Answer
Additional Notes
- Additional Bypass Reasons and Remediation options were added in the 14 April 2022 CBC Console Release. See Release Note below
DSER-38817: Added more sensor state/bypass descriptions to side panel
- If reaching out to support please provide Sensor logs from impacted devices
- Double-quotes are not required around values, but can be used
Example
Both sensorStates:"UNSUPPORTED_OS" and sensorStates:UNSUPPORTED_OS work for searching
- Multiple values can be searched simultaneously
Either of the below searches work to show any/all devices with one of the Sensor States where a reboot should be the first remediation step attempted.
sensorStates:(DRIVER_INIT_REBOOT_REQUIRED OR DRIVER_LOAD_PENDING OR DRIVER_INIT_ERROR)
OR
sensorStates:DRIVER_INIT_REBOOT_REQUIRED OR sensorStates:DRIVER_LOAD_PENDING OR sensorStates:DRIVER_INIT_ERROR
Related Content
