Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Does EDR Support VDI for Linux Endpoints?

EDR: Does EDR Support VDI for Linux Endpoints?


  • EDR Server: 7.4+
  • EDR Sensor: 7.x+
  • Linux


Does EDR Support VDI for Linux Endpoints? 


Yes, Linux can be configured at the Sensor Group and Global levels.
Enable VDI Support   
 1.  Add the following lines in cb.conf
2.  Restart cb-enterprise services or cbcluster.
Sensor Group Setting 
 1.  Click Sensors in UI navigation bar.
2.  Click the Edit Settings tab.
3.  On Advanced tab, select the VDI Behavior Enabled checkbox.
4.  Click Save Changes button to enable the configuration.
Globally VDI for LinuxTo create a gold image.
 1. Install the Linux sensor.
2.  Stop cbdaemon
systemctl stop cbdaemon
3. Remove any stored binary or event data.
rm -rf /var/opt/carbonblack/response/store/*
rm -rf /var/opt/carbonblack/response/eventlogs/*
4.   Enable VDI in sensorsettings.ini
vim /var/opt/carbonblack/response/sensorsettings.ini
5.  Set the Sensor ID to 0 allowing the EDR server to assign new VMs with a new Sensor ID
vim /var/opt/carbonblack/response/config.ini
6.  Start the cbdaemon in the gold image VM. 
systemctl start cbdaemon

Additional Notes

  • Virtual Desktop Infrastructure (VDI) when enabled allows EDR to correlate the VMs characteristics (i.e., hostname and DNS name) to an existing sensor.

Related Content

Labels (1)
Tags (2)
Was this article helpful? Yes No
50% helpful (1/2)
Article Information
Creation Date: