Carbon Black Cloud: What are the Sensor Bypass Reasons and Remediation Options?

[#1]

Environment

• Carbon Black Cloud: 14 April 2022 Release and Above
• Linux: All Supported Versions
• MacOS: All Supported Versions
• Microsoft Windows: All Supported Versions

Question

What are the reasons a device goes into bypass mode, and what can be done to correct it?

Answer

This information can be found in the User Guide.
 

Additional Notes

• Additional Bypass Reasons and Remediation options were added in the 14 April 2022 CBC Console Release. See Release Note below 

  DSER-38817: Added more sensor state/bypass descriptions to side panel

• If reaching out to support please provide Sensor logs from impacted devices
  • Carbon Black Cloud: How to Collect Sensor logs locally (Linux)
  • Carbon Black Cloud: How to Collect Sensor logs locally (macOS)
  • Carbon Black Cloud: How to Collect Sensor logs locally (Windows)
• Double-quotes are not required around values, but can be used

  Example
  Both sensorStates:"UNSUPPORTED_OS" and sensorStates:UNSUPPORTED_OS work for searching

• Multiple values can be searched simultaneously

  Either of the below searches work to show any/all devices with one of the Sensor States where a reboot should be the first remediation step attempted.
  
  sensorStates:(DRIVER_INIT_REBOOT_REQUIRED OR DRIVER_LOAD_PENDING OR DRIVER_INIT_ERROR)
  
  OR
  
  sensorStates:DRIVER_INIT_REBOOT_REQUIRED OR sensorStates:DRIVER_LOAD_PENDING OR sensorStates:DRIVER_INIT_ERROR

Related Content

Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)
VMware Carbon Black Cloud Console Release Notes