Carbon Black Cloud: How to manually Update Virus Definition Signature via RepCLI

[#1]

Environment

• Carbon Black Cloud Sensor: 3.3 and Higher
• Microsoft Windows: All Supported Versions

Objective

How to manually Update Virus Definition Signature via RepCLI

Resolution

Sensor Version 3.6 and Higher

1. Launch Command Prompt.
2. Execute the following command to force a signature update

   "%ProgramFiles%\Confer\RepCLI.exe" localscanner updatesignature -wait
   

   Success Message: The signature update has finished
   Failure Message: Error: The signature update has failed, see upd.log and confer.log for more details. Command failed

 

Sensor Version 3.5 and Lower

1. Navigate to the path where RepCLI is located, usually %ProgramFiles%/Confer; as per How to Access RepCLI Utility
2. Run RepCLI Unlock <code> or put the sensor in bypass mode so that you are able to run privilege commands.
3. Run:

"%ProgramFiles%\Confer\RepCLI.exe" UpdateAvSignature -wait

Success Message: The request of AV signature update has been requested
Failure Message: Error: Failed to trigger the signature update, see confer.log for more details Command failed

Additional Notes

• As of the 3.5 Sensor, command line signature updates no longer require RepCLI Authentication and can be run as a script or scheduled task.
• Virus Definition Files are required only when "On-access file scan mode" is set to Normal or Aggressive.
• If the "Allow signature updates" Policy setting is Disabled, signature updates via RepCLI will fail.

Related Content

Carbon Black Cloud: How to Access RepCLI Utility
Cb Defense: How To Configure Local AV Scan
Cb Defense: Best Practices for Deploying Local Scanner