IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How to Use Live Response to Collect Sensor Diags

EDR: How to Use Live Response to Collect Sensor Diags

Environment

  • EDR Server: 6.0.1 and Higher (formerly CB Response)
  • Microsoft Windows: All Supported Versions
  • 7zip

 

Objective

To obtain sensor/endpoint diagnostics with the help of CB response Live response (CBLR)
 

Resolution

6.2.2 and Above:

  1. Open Live response session from EDR Console.
  2. Generate sensor diagnostics by running the following command:
    • execfg sensordiag.exe --type CDE
  3. Obtain the .zip by running 
    • get C:\Windows\CarbonBlack\diags\<filename>.zip
  4. A pop up will be prompt you to save the file.

Sensor Version 6.2.1 and Below:

  1. Open Live response session from EDR Console.
  2. Generate sensor diagnostics by running the following command:
    • execfg sc control carbonblack 200
  3. Confirm that diagnostics logs have been generated at C:\windows\carbonblack\diagnostics  by checking that there is a list of current .log files there.
  4. Zip the diagnostic directory by running the following command from 7zip installation directory:
    • execfg 7zG a -tzip diagnostics.zip C:\windows\carbonblack\diagnostics 
    • Example:
    • C:\Program Files\7-zip>  7zG a -tzip diagnostics.zip C:\windows\carbonblack\diagnostics
  5. Obtain the resultant .zip file by running:
    • C:\windows\carbonblack>  get diagnostics.zip
  6. A pop up will be prompt you to save the file

Additional Notes

7zip can be downloaded from https://www.7-zip.org/download.html and can be pushed on to the endpoint using the CB Live Response.


 

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
3458
Contributors