Environment
- Carbon Black Cloud Web Console: All Supported Versions
- Endpoint Standard Sensor: 3.3.x.x and Higher
- Microsoft Windows: All Supported Versions
Objective
Force the Sensor to check in with the Web Console utilizing various RepCLI Cloud Commands
Resolution
- Log into the machine with a user account that matches the AD User or Group SID configured at the time of sensor install.
- Launch a Command Prompt.
- Change directory to C:\Program Files\Confer
cd C:\Program Files\Confer
- Enter the following command. If successful, "Successfully scheduled request" will print to the command line
repcli cloud hello
- The following table includes all repcli cloud command options and their expected results
RepCLI Cloud Option
(not case sensitive) | Result |
|---|
| hello | Sensor to checks in with the Web Console |
| QueryConfig | Sensor checks for update to Policy configuration settings |
| QueryRules | Sensor downloads and updates Policy rules |
| Metadata | Sensor sends updated system information to the Web Console |
| Zip | Sensor downloads a zipped file containing both Configuration setting and Policy rules and applies new settings |
| UninstallCode | Sensor checks for an update to the Uninstall Code |
| RepConfig | Sensor downloads and applies Whitelist/Blacklist configuration including IT Tools and Cert Whitelisting |
| SensorState | Uploads sensor active state to Web Console |
| Alarms | Uploads any Sensor alarms to Web Console |
| DeviceInfo | Uploads Sensor name and SID to Web Console |
| PscReport | Uploads Cb ThreatHunter messages |
| UbsQuery | Checks for files that Web Console has requested from Sensor |
| UbsUpload | Begins upload of any requested files |
Additional Notes
- The command options in the table are not case sensitive and only include capital letters for readability
- All of the above commands options should be preceeded by "repcli cloud" in the command string
- Active Directory-based SID authentication is required to run the "repcli cloud" commands
- While the "repcli cloud" commands will often complete immediately, there may be other queued tasks that will complete first
- The printed response in the command line of "Successfully scheduled request" reflects the fact that tasks are queued
Related Content
