Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

VDI - Check for duplicates by only Hostname and not DNS Name

VDI - Check for duplicates by only Hostname and not DNS Name

Version

Cb Response 5.x

Topic

How to remove the check for duplicates caused by multiple DNS Names for a single sensor.

Steps

  1. Check if computer_dns_name is the same across duplicates. This setting isn’t currently displayed in the UI and needs to be queried via SSH:
    psql -d cb -p 5002 -c "SELECT id,computer_name,computer_dns_name,last_checkin_time,registration_time FROM sensor_registrations ORDER BY computer_name;"
  2. If this is the case, the default_new_sensor_registration_callback.py can be
    cp /usr/share/cb/plugins/default_new_sensor_registration_callback.py /usr/share/cb/plugins/custom_new_sensor_registration_callback.py
  3. Modify custom_new_sensor_registration_callback.py to only check on the computer hostname rather than hostname and dns name by commenting out this line:
    #.filter(SensorRegistration.computer_dns_name == sensor_dns_name) \

    Note: Make sure tabbing in the file remains the same.

  4. Once changes are made, verify the script compiles with this command and fix any errors:
    python /usr/share/cb/plugins/custom_new_sensor_registration_callback.py
  5. Make changes in /etc/cb/cb.conf to import the new script
    From:
    NewRegistrationCallbackModulePath=/usr/share/cb/plugins/default_new_sensor_registration_callback.py
    To:
    NewRegistrationCallbackModulePath=/usr/share/cb/plugins/custom_new_sensor_registration_callback.py
  6. Restart the server
    1. For single server environments:
      service cb-enterprise restart
    2. For clusters:
      /usr/share/cb/cbcluster stop
      /usr/share/cb/cbcluster start
Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-30-2016
Views:
1356
Contributors