Environment
- Endpoint Standard (formerly CB Defense PSC) Console: All Versions
- Endpoint Standard Sensor: 3.1.x.x and Higher (Windows), 3.2.x.x and Higher (Mac)
- Microsoft Windows: All Supported Versions
- Apple macOS: All Supported Versions
- Mass Sensor Management (MSM), aka Sensor Groups
Objective
Provide guidance on creating Sensor Groups in the Carbon Black Cloud (CBC) Console
Resolution
- Go to Endpoints
- Click '+Add Group' button
- Click 'Continue and create group' button on group creation pop-up
- Enter a Group Name as desired
- Select OS criteria
Any, Windows, Mac
- Set 'Sensors that meet... of these criteria will be added to this group' to 'all' or 'any' as desired
- Set 'Select criteria' field
Active Directory Organizational Unit
Active Directory Domain
Active Directory Distinguished Name
Device Name
Subnet
- Set second drop-down as desired
contains
is equal to
is not equal to
starts with
ends with
- Enter desired text for matching
- Add additional Criteria by clicking the Add icon (+) to the far-right of the line added in the above steps if desired
- Select the Policy to assign to Sensors meeting the criteria of the Sensor Group
- Click 'Save'
- Click 'Add Group'
Additional Notes
When creating MSM Groups for auto-assigning Sensors to Policies, it is important to remember the following
- Domain Name is case sensitive (use both uppercase and lowercase variations)
- Hostname/Device Name is case sensitive (use both uppercase and lowercase variations)
- Use a double backslash (\\) between Domain and Hostname (domain\\hostname)
- Add criteria in descending order of specificity (i.e., most specific to least specific) to avoid mix-ups
- Case sensitivity and the need for a double backslash will be resolved in future releases of the Endpoint Standard Web Console
- Ordering criteria is important to make sure shorter character strings are not errantly matched within longer strings
- The Active Directory Domain should match the Domain Name listed under the Distinguished Names of your devices
Examples
Domain, Hostname, and backslashes
- YOURDOMAIN\\HOSTNAME
- yourdomain\\hostname
- YOURDOMAIN\\hostname
- yourdomain\\HOSTNAME
Ordering Criteria
- YourDomain\\SECURITY
- YourDomain\\IT
IT can be found in Security, so filter out the devices with Security in the name before those with just IT in the name
Related Content
