Update: July 19, 2018
Cb Response Linux v6.1.7 is now available for Controlled Distribution (CD). Fixes were introduced to help address the Linux interoperability issues. Please see the release notes and technical note below for more information.
Cb Response Linux Sensor v6.1.7 Release Notes.pdf
Technical Note Carbon Black Linux Sensor Kernel Module Unload Changes.pdf
Please refer to the following post for more information on the CD release.
[Cb Response] Announcing Controlled Distribution of v6.1.7 and v5.2.17 Linux Sensor
Update: June 6, 2018
All,
We are aware of three interoperability issues causing kernel panics when using the Cb Response Linux 6.1.x and 5.2.x sensors and the following:
- TripWire
- eTrust
- Debug Kernel
Actions
- Please do not run the debug kernel to avoid a kernel panic. We do not officially support Cb Response Linux on a debug kernel.
- If you wish to run eTrust or Tripwire, load those products kernel modules first before you load the Cb Response kernel module
If, after you change the “load order” of your kernel modules, you continue to experience issues, please open a Support case.
We are actively working on a solution that will be addressed in our upcoming 6.1.6 release.
Status updates will be provided here on this post. We apologize for any inconvenience this may have caused.
Thanks,
The Cb Response Team
#EDR