Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: How to Determine the Cluster Configuration

EDR: How to Determine the Cluster Configuration

Environment

  • EDR Server: 6.0 and Higher

Question

How to determine an EDR cluster configuration?

Answer

The /etc/cb/cluster.conf file from the master server contains information about the entire cluster.  

Sample file contents:
  • [Cluster]
    NodeCount=2
    NextSlaveAutoInc=7

    [Master]
    Host={IP Address}  
    User=root
    HasEvents=True
    ReadOnly=False

    [Slave1]
    Host={IP Address}
    User=root
    HasEvents=True
    ReadOnly=False
This output represents a master + 1 minion cluster. 

Additional Notes

  • If all sensors reside on Node ID of 0, then most likely this means it is a Standalone setup. 
  • If sensors have a Node ID of 1 or above, then most likely it is a cluster.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-19-2022
Views:
128
Contributors