Carbon Black Cloud: How to Upgrade Sensors from the Carbon Black Cloud Console

[#1]

Environment

• Carbon Black Cloud Web Console: All Versions (formerly Predictive Security Cloud or PSC)
• Carbon Black Cloud Sensor: All Supported Versions
  • Endpoint Standard (formerly CB Defense)
  • Enterprise EDR (formerly CB ThreatHunter)
  • Audit & Remediation (formerly CB LiveOps)
    • Microsoft Windows: All Supported Versions
    • Apple macOS: All Supported Versions
    • Linux: All Supported Versions

Objective

Provide steps for updating Sensors from the Carbon Black Cloud Console

Resolution

1. In the Carbon Black Cloud Console, go to the Endpoints page
2. Use the Search Bar to limit the displayed results to the Devices you wish to update
3. Check the boxes for these Devices
4. Click the 'Take Action' Button
5. On the menu shown, click 'Update Sensors' 
6. Select the desired Sensor Version for the appropriate Operating System
7. Check the box for "I understand that devices may be rebooted"
8. Click the Update Button
9. A confirmation message should show at the top of the web page
10. The next time the Sensor checks in, a random time will be selected in the next 4 hours for when the Sensor will download and update to the selected Version

Additional Notes

• The following can be used to limit the Search results for the Endpoints page
  • Device name
  • Current Sensor version
  • Policy
  • IP Address
  • The Operators (AND, OR, NOT) along with wildcard characters (*, **, ?) can be used to help refine the search
• Sensors cannot be reverted or downgraded to a previous version
• The check box for "I understand that devices may be rebooted" is not optional. Check the release documents for Sensor versions for any announcements regarding this. We always recommend small scale upgrades to check for possible issues before wide scale upgrades. 
• To confirm Devices have updated search for them 4 hours later, as the Console will show the new Sensor version on reporting and the upgrade will execute within that time. It's possible to search on Endpoints for "NOT <enter the latest Sensor Version here>" to see what Devices are not reporting the latest version.