Incident Response Exchange

Incident Response Deployment 

Table of Contents:

1. IR Deployment Considerations
2. Pre-Deployment
3. Deployment
4. Post-Deployment

Pre-Deployment 

• OS Sensor Support 
  • Carbon Black Cloud Sensor Support 
  • Carbon Black Cloud: What Ports must be opened on the Firewall and Proxy Servers? 
    
    
• Network Exclusions / Permissions 
  • CB Defense: What's the static IP address or hostname used by CB Defense? 
  • Carbon Black Cloud: How to Set up Exclusions in the Carbon Black Cloud Console for other AV Products 
    
    
• Third Party Security Tool(s) Exclusions / Permissions 
  • Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions 
    
    
• Workloads 
  • Onboarding with VMware Carbon Black Workload 
    
    
• Installation Guide(s) 
  • Carbon Black Cloud Sensor Installation Guide 
  • Workload Installation Guide 

Deployment 

• Windows Installation 
  • Carbon Black Cloud: How to Get Started with SCCM Deployment 
  • PSC: How to Get Started with GPO Deployment 
    
    
  • RepCLI Utility 
    • Endpiont Standard: How to Enable RepCLI Authentication on Exisitng Sensors 
    • Cb Defense: How to Enable Authentication for RepClI Utility 
    • Carbon Black Cloud: How to Enable RepCLI Autentication With Live Response on Existing Sensors 
  • VDI 
    • How to Install to Horizon VDI 
    • How to Deploy Sensor to a non-persistent VDI 
      
      
• Mac Installation 
  • CB Defense: How to Deploy Sensor to Mac With Jamf Pro 
  • Endpoint Standard: How to Perform an Unattended Installation of the Mac Sensor 
  • CB Defense: How to Deploy Sensor to Mac with Jamf Cloud 
  • CB Defense: How to approve KEXT on JAMF 
    
    
• Linux Installation 
  • Carbon Black Cloud: How to Deploy the CBC Sensor on Linux Environment 
  • Carbon Black Cloud: How to Customize the CBC Installer for Linux to Install Just LiveOps 
  • Carbon Black Cloud: How to Install Linux Sensor Manually 

Post-Deployment 

• Policy Configuration 
  • Carbon Black Cloud: How to Configure Policy Rules 
  • Carbon Black Cloud: Policy Recommendations for Developer's Workstations and Build Servers 
    
    
• TAU Prevention Recommendation Examples 
  • Endpoint Standard: What are the Recommended Rules for Preventing and Detecting RYUK Ransomware 
  • CB PSC: How to Prevent the Recent Emotet Campaign? 
  • CB PSC: How to Prevent DRIDEX? 
    
    
• Upgrade Sensors 
  • Carbon Black Cloud: How Long Does it Take for a Sensor to Upgrade After It's Requested? 
  • Carbon Black Cloud: How to Manually Upgrade Linux Sensor 
  • Carbon Black Cloud: How to Update Sensors from the Carbon Black Cloud Console 
  • Endpoint Standard: How to Configure SCCM to Allow Sensor Upgrades 
  • PSC: How to Configure GPO to Allow Sensor Upgrades 
    
    
• Uninstall 
  • How to Uninstall Mac 3.x.x Sensor 
  • Endpoint Standard: How to uninstall the Windows Sensor 
  • Carbon Black Cloud: How to Uninstall the PSC for Linux sensor 
  • Carbon Black Cloud: How to clean up Windows Sensor remnants using Sensor Removal Tool after failed uninstall
  • Carbon Black Cloud Windows Sensor Removal Tool
    
    
• Troubleshooting / Log Collection 
  • CB Defense: How to Troubleshoot CB Defense Issues 
  • Carbon Black Cloud: How To Collect Sensor Logs Locally (Windows) 
  • Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)