Cb Response: How do you determine the previous version of the endpoint software that was installed?

[#1]

Environment

• Cb Response Sensor: All Supported Versions

Question

How do you determine the previous version of Cb Response sensor software that an endpoint sensor was running?

Answer

1. Review the sensor.log file.
2. Look for the version from a log entry that occurred before the upgrade.

Additional Notes

• Windows sensor log file: %WINDIR%\CarbonBlack\Sensor.log 
• Linux sensor log file: /var/log/cbsensor
• There's no way to query the server or endpoint to determine what the previous version of the Cb Response sensor software was. The sensor.log file generally goes back only a couple of days, so if the upgrade occurred more recently than that, then the previous version may not be available to be known. 

Related Content

CB Response: Generate Windows sensor report