Carbon Black (P5:Inventory): A Practical Guide/An Practical Training
- Aug 5
- 4 min read
The Feature Inventory in Carbon Black Cloud is an essential tool that helps administrators and security professionals manage and investigate their endpoint security posture effectively. Let’s dive into its key components, starting with the Endpoints tab, and explore the features and capabilities it provides.
Endpoints Tab
The Endpoints tab is your starting point for managing and investigating endpoints in your environment. Below is an overview of its layout and functionality:
Filters for Investigation On the left-hand side of the tab, you’ll find several filters that simplify endpoint investigations. These filters include:
Sensor Status: Displays whether sensors are active, inactive, or in an error state.
Operating System (OS): Allows you to filter endpoints by their operating system.
Sensor Version: Helps identify which version of the Carbon Black sensor is installed.
Other Metadata Filters: These include options for grouping endpoints by their organizational unit, IP range, or other custom tags.
Each filter is self-explanatory and designed to make pinpointing specific endpoints quick and efficient.
Top-Right Controls At the top-right corner of the screen, you’ll find two key options:
Sensor Options The Sensor Options menu provides several actions to manage sensors:
Manage Sensor Settings: Enables deletion of unused sensors.
View Company Code: Displays the company code required during sensor installation.
Download Sensor Kit: Offers the installation package for the sensor.
Send Installation Request: Allows you to email installation instructions by entering the recipient’s details.
Add Group: The Add Group feature helps you dynamically assign sensors to specific groups based on predefined criteria:
Sensors matching all criteria for a group are added automatically.
If a sensor does not match any group’s criteria, it is assigned to the default Standard policy.
Group assignments are dynamic and will change if a sensor no longer meets the criteria for its current group.
You can define group criteria using “AND” or “OR” conditions, offering flexibility in your configurations.
Note: Sensors can belong to only one group at a time. If multiple groups match, the sensor is assigned to the group with the highest priority.
Sensor Update Status
Adjacent to the Endpoints tab, you’ll find the Sensor Update Status section. This feature displays:
Sensor versions installed across your environment.
Details of sensors requiring updates or showing errors
-------------------------------------------------------------------------------------------------------------
Live Example: Viewing Sensor Details
When sensors are available, you’ll see details organized by status. Filters such as Sensor Status or Signature Status provide critical insights:
Sensor Status: Carbon Black provides detailed statuses for sensors, including connectivity and operational health. For example:
Active: Sensors reporting data and functioning correctly.
Inactive: Sensors not reporting or disabled.
Error: Sensors with connectivity or configuration issues.
Signature Status:
The Sig column in the interface indicates the status of sensor signatures:
Signature version status
Circle: Signatures are up to date (released within the last 7 days).
Triangle: Signatures are outdated (older than 7 days).
Square: Signatures are unreported or unidentifiable, possibly due to local scan configuration issues or connectivity errors.
These visual indicators make it easy to assess and prioritize updates or troubleshooting efforts.
Sensor update status:
Actions on Endpoints
When managing endpoints in Carbon Black Cloud, you can take the following actions:
Add to Asset Groups
Add selected endpoints to specified asset groups (if you’re using this feature).
Remove from Asset Groups
Remove endpoints from specific asset groups.
Assign Policy
Assign a prevention policy to determine sensor behavior.
Update Sensors
Update the sensor version on selected endpoints.
Start Background Scan
Initiate a one-time inventory scan to identify pre-existing malware.
If the controlling policy includes background scan settings, the scan type (standard or expedited) will follow that policy. Otherwise, the default is a standard scan.
Pause Background Scan
Temporarily stop the background scan. It will restart when the service or endpoint restarts.
Enable/Disable Bypass
Enable bypass: Temporarily disable policy enforcement on the endpoint.
Disable bypass: Reinstate policy enforcement.
Quarantine/Unquarantine Assets
Quarantine an endpoint to limit its outbound traffic and block inbound traffic.
Release an endpoint from quarantine when it is no longer a threat.
Uninstall Sensors
Remove macOS and Windows sensors. After removal, the sensor will appear as deregistered until deleted.
Delete Deregistered Assets
Fully remove a sensor from the Carbon Black Cloud console.
Disable Live Response
Disable Live Response for remote investigations and remediation. Re-enabling it requires sensor reinstallation.
Query Assets
Run SQL queries against endpoints to gather specific information.
Manage Sensor Gateway Connection
Control whether endpoints communicate directly with Carbon Black Cloud or through a Sensor Gateway.
Investigate and Go Live: Threat Hunting and Commands
Each endpoint provides several options for deeper investigation. Below are some key features:
Investigate
This is your go-to option for threat hunting. If you want detailed steps on this, check out our article below
Mention Link:
Go Live
The "Go Live" option allows you to run live commands on an endpoint. These commands can be invaluable during an active investigation.
Query Asset
Last Option (Prebuilt queries)
USB Devices Management
Under the "USB Devices" tab, you can monitor connected USB devices. The filters and options available here are self-explanatory, as shown in the screenshot below (see attachment).
However, you might wonder, how do I block USB devices?
The answer lies in creating a policy. When setting up a policy (as detailed in this article), you can include rules for blocking USB devices.
Once a device is blocked, you will see an option to approve or reject it directly under the "USB Devices" tab.
Example Scenario:
A USB device is blocked by policy.
Navigate to the "USB Devices" tab to see the blocked device.
Approve the device if needed, or leave it blocked.
Sensor Groups
We’ve discussed sensor groups earlier. For more details, refer to the "Actions on Endpoints" section above. Sensor groups are an efficient way to manage multiple endpoints with similar configurations or policies.
Conclusion
By understanding these features, you can take full advantage of Carbon Black Cloud for endpoint management, threat hunting, and USB device control. Use the tools wisely to enhance your organization's cybersecurity posture.
Keep experimenting with these settings, and don’t hesitate to tweak configurations based on your organization's needs. I’ll leave you here for now, but stay tuned for my next guide—there’s always more to learn!
Upcoming Article: Carbon Black (P6:Settings): A Practical Guide/An Practical Training
Comments