This page is an aggregate of all OER topics onto a single page for more convenient HTML viewing.
Linux Hardware Recommendations
Endpoints should comply with all hardware requirements for the OS you are running. Consider all processes that run on the endpoints when determining hardware configuration. Only industry standard desktop, laptop, or notebook computers and server hardware platforms are supported. Mobile and tablet require additional qualifications. Please contact VMware Carbon Black Support for additional information.
Note: The sensor's CPU and Memory usage will vary (increase or decrease) in response to other system activity because its job is to monitor, record, and respond to such activity. The following requirements are in addition to peak resource usage by the system when the sensor is not installed or is in bypass, and represent a worst case scenario. The sensor should not use more resources than what is listed in the following tables, but can use significantly less resources depending on the system workload.
| Metric | Endpoint Standard | Endpoint Standard + Enterprise EDR | Endpoint Standard + Enterprise EDR + Audit & Remediation |
| CPU | Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
| Memory | 2 GB | 2 GB | 2 GB |
| Cores | 2 | 2 | 2 |
| Network Required | Minimum: 100 Mbit Recommended: 1 Gbit |
Minimum: 100 Mbit Recommended: 1 Gbit |
Minimum: 100 Mbit Recommended: 1 Gbit |
| Minimum network during light usage | 1k bytes/sec read/writes each | 1k bytes/sec read/writes each | 1k bytes/sec read/writes each |
| Free disk space | /opt: 100 MB /var: 1600 MB |
/opt: 100 MB /var: 2600 MB |
/opt: 100 MB /var: 3200 MB |
| Metric | Audit & Remediation | Enterprise EDR + Audit & Remediation |
|---|---|---|
| CPU | Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
| Memory | 10 MB | 110 MB |
| Cores | 1 | 2 |
| Network Required | Minimum: 100 Mbit Recommended: 1 Gbit |
Minimum: 100 Mbit Recommended: 1 Gbit |
| Minimum network during light usage | 1k bytes/sec read/writes each | 1k bytes/sec read/writes each |
| Free disk space | /opt: 100 MB /var: 900 MB |
/opt: 100 MB /var: 2200 MB |
| Metric | Enterprise EDR | Enterprise EDR + Endpoint Standard | Enterprise EDR + Endpoint Standard + Audit & Remediation |
|---|---|---|---|
| CPU | Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
Any 64-bit x86-64 or ARMv8 based Graviton (aarch64/arm64) family processor based chipset No speed required |
| Memory | 100 MB | 250 MB | 250 MB |
| Cores | 2 | 2 | 2 |
| Network Required | Minimum: 100 Mbit Recommended: 1 Gbit |
Minimum: 100 Mbit Recommended: 1 Gbit |
Minimum: 100 Mbit Recommended: 1 Gbit |
| Minimum network during light usage | 1k bytes/sec read/writes each | 1k bytes/sec read/writes each | 1k bytes/sec read/writes each |
| Free disk space | /opt: 100 MB /var: 1600 MB |
/opt: 100 MB /var: 2600 MB |
/opt: 100 MB /var: 3200 MB |
| Metric | Prevention |
|---|---|
| CPU | Any 64-bit x86-64 chipset No speed required |
| Memory | 100 MB |
| Cores | 2 |
| Network Required | Minimum: 100 Mbit Recommended: 1 Gbit |
| Minimum network during light usage | 1k bytes/sec read/writes each |
| Free disk space | /opt: 100 MB /var: 1600 MB |
Linux Operating Systems and Respective Sensors
This topic describes Carbon Black Cloud Linux Sensors and operating systems.
For users of Carbon Black Cloud on AWS GovCloud (US), see Linux Supported Operating Systems and Sensors for AWS GovCloud (US) for system information specific to your environment.
Please see the Carbon Black Cloud Sensor Support Policy and the Linux Sensor Support Life Cycle Status page for information regarding Standard or Extended support for specific versions of the Linux sensor.
The Carbon Black Cloud Linux sensor offers support for the Graviton (aarch64) chipset. Graviton support is offered on the eBPF OS distributions with glibc version of 2.28 or higher.
Note:
- "-" indicates through and inclusive of; for example, 2.12-2.15 indicates 2.12.x through and inclusive of 2.15.x.
- Kernel versions listed are supported by the sensor together with the kernel versions prior to the specified version. Future kernel versions that GA with the OS are not supported until Carbon Black qualifies them for support. For example, for RHEL 9.1 the kernel version 5.14.0-162 indicates up to but not including 5.14.0-284. This is the kernel version that RHEL 9.2 released.
- For the quarantine feature to function efficiently, IPtables is a pre-requisite on all Linux distributions. See the Sensor Installation Guide.
Important: Some sensor versions listed here might no longer be supported. Please consult the
Linux Sensor Support Life Cycle Status page for information on sensor life cycle support status.
Endpoint Standard Linux Sensor Supported Distributions and Kernel Versions
This topic describes Carbon Black Cloud Linux Sensors and operating systems for Endpoint Standard.
Note:
- "-" indicates through and inclusive of; for example, 2.12-2.15 indicates 2.12.x through and inclusive of 2.15.x.
- Kernel versions listed are supported by the sensor together with the kernel versions prior to the specified version. Future kernel versions that GA with the OS are not supported until Carbon Black qualifies them for support. For example, for RHEL 9.1 the kernel version 5.14.0-162 indicates up to but not including 5.14.0-284. This is the kernel version that RHEL 9.2 released.
- Kernel version 4.4+ is required for RHEL8, CentOS8, Oracle 8, Oracle UEK, Amazon, SUSE, and Ubuntu.
- ***UEK kernel is only supported in 2.11.0+.
|
|
|
|
| Distribution | Kernel Version | Sensor Version x86_64 | Sensor Version aarch64 (AWS Graviton processors) |
|---|---|---|---|
| 9.3 | 5.14.0 | 2.16.0 | 2.16.0 |
| 9.2 | 5.14.0 | 2.15.1-2.16.0 | 2.15.1-2.16.0 |
| 8.10 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.9 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.8 | 4.18.0 | 2.15.1-2.16.0 | 2.15.1-2.16.0 |
| Distribution | Kernel Version | Sensor Version x86_64 | Sensor Version aarch64 (AWS Graviton processors) |
|---|---|---|---|
| 9.3 | 5.14.0 | 2.16.0 | 2.16.0 |
| 9.2 | 5.14.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
| 8.10 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.9 | 4.18.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
| 8.8 | 4.18.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
Enterprise EDR Linux Sensor Supported Distributions and Kernel Versions
This topic describes Carbon Black Cloud Linux Sensors and operating systems for Enterprise EDR.
Note:
- "-" indicates through and inclusive of; for example, 2.12-2.15 indicates 2.12.x through and inclusive of 2.15.x.
- Kernel versions listed are supported by the sensor together with the kernel versions prior to the specified version. Future kernel versions that GA with the OS are not supported until Carbon Black qualifies them for support. For example, for RHEL 9.1 the kernel version 5.14.0-162 indicates up to but not including 5.14.0-284. This is the kernel version that RHEL 9.2 released.
- Kernel version 4.4+ is required for RHEL8, CentOS8, Oracle 8, Oracle UEK, Amazon, SUSE, and Ubuntu.
- **UEK kernel is only supported in 2.10.1+.
|
|
|
|
| Distribution | Kernel Version | Sensor Version x86_64 | Sensor Version aarch64 (AWS Graviton processors) |
|---|---|---|---|
| 9.3 | 5.14.0 | 2.16.0 | 2.16.0 |
| 9.2 | 5.14.0 | 2.15.1-2.16.0 | 2.15.1-2.16.0 |
| 8.10 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.9 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.8 | 4.18.0 | 2.15.1-2.16.0 | 2.15.1-2.16.0 |
| Distribution | Kernel Version | Sensor Version x86_64 | Sensor Version aarch64 (AWS Graviton processors) |
|---|---|---|---|
| 9.3 | 5.14.0 | 2.16.0 | 2.16.0 |
| 9.2 | 5.14.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
| 8.10 | 4.18.0 | 2.16.0 | 2.16.0 |
| 8.9 | 4.18.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
| 8.8 | 4.18.0 | 2.15.2-2.16.0 | 2.15.2-2.16.0 |
Audit and Remediation, Workloads, and Vulnerability Management Linux Sensor Supported Distributions
This topic describes Carbon Black Cloud Linux Sensors and operating systems for Audit and Remediation, Workloads, and Vulnerability Management.
Note:
- All kernel versions are supported on Audit and Remediation.
- Carbon Black does not support RHEL/CentOS/Oracle 6.5 and below in sensor version 2.9.1. We recommend that if you are running these operating system versions, to update to a more recent version of RHEL/CentOS/Oracle.
- While Carbon Black Cloud supports sensor installations on Debian OS, it is not currently available for installation using the vSphere Console or the Carbon Black Cloud console. You can still perform such an installation by downloading the sensor kit from the Carbon Black Cloud console and then proceeding with manual installation. For more information, see Installing Linux Sensors on Endpoints.
- "-" indicates through and inclusive of; for example, 2.12-2.15 indicates 2.12.x through and inclusive of 2.15.x.
| Distribution | Distribution Version | Sensor Versions x86-64 | Sensor Version aarch64 (AWS Graviton processors) | ||
|---|---|---|---|---|---|
| Audit and Remediation | Workloads | Vulnerability Management | Audit and Remediation | ||
| RHEL 9 | 9.3 | 2.16.0 | 2.16.0 | Not Supported | 2.16.0 |
| 9.2 | 2.15.0-2.16.0 | 2.15.0-2.16.0 | Not Supported | 2.15.0-2.16.0 | |
| 9.1 | 2.14.1-2.16.0 | 2.14.1-2.16.0 | Not Supported | 2.14.1-2.16.0 | |
| 9.0 | 2.14.1-2.16.0 | 2.14.1-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 | |
| RHEL 8 | 8.9 | 2.15.2 | 2.15.2 | Not Supported | 2.15.2 |
| 8.8 | 2.15.0-2.16.0 | 2.15.0-2.16.0 | Not Supported | 2.15.0-2.16.0 | |
| 8.2-8.7 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 | |
| 8.0-8.1 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported | |
| RHEL 7 | 7.0-7.9 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported |
| RHEL 6 | 6.6-6.10 | 2.4.0-2.11.3 | 2.9.0-2.11.3 | 2.9.0-2.11.3 | Not Supported |
| CentOS 8 | 8.5 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | Not Supported | 2.14.1-2.16.0 |
| 8.2-8.4 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 | |
| 8.0-8.1 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported | |
| CentOS 7 | 7.0-7.9 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported |
| CentOS 6 | 6.6-6.10 | 2.4.0-2.11.3 | 2.9.0-2.11.3 | 2.9.0-2.11.3 | Not Supported |
| Oracle 9 | 9.3 | 2.16.0 | 2.16.0 | Not Supported | Not Supported |
| 9.2 | 2.15.0-2.16.0 | 2.15.0-2.16.0 | Not Supported | Not Supported | |
| 9.1 | 2.14.1-2.16.0 | 2.14.1-2.16.0 | Not Supported | Not Supported | |
| 9.0 | 2.13.3-2.16.0 | 2.15.0-2.16.0 | Not Supported | Not Supported | |
| Oracle 8 | 8.9 | 2.15.2 | 2.15.2 | Not Supported | Not Supported |
| 8.8 | 2.15.0-2.16.0 | 2.15.0-2.16.0 | Not Supported | Not Supported | |
| 8.0-8.7 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | Not Supported | Not Supported | |
| Oracle 7 | 7.0-7.9 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | Not Supported | Not Supported |
| Oracle 6 | 6.6-6.10 | 2.4.0-2.11.3 | 2.9.0-2.11.3 | Not Supported | Not Supported |
| SUSE 15 | 15.5 | 2.15.1-2.16.0 | 2.15.1-2.16.0 | Not Supported | 2.15.1-2.16.0 |
| 15.4 | 2.14.0-2.16.0 | 2.14.0-2.16.0 | 2.10.0-2.13.3 | 2.14.1-2.16.0 | |
| 15-15.3 | 2.11.0-2.16.0 | 2.11.0-2.16.0 | 2.10.0-2.13.3 | Not Supported | |
| SUSE 12 | 12.2-12.5 | 2.11.0-2.11.3 | 2.9.0-2.11.3 | 2.9.0-2.11.3 | Not Supported |
| OpenSUSE 15 | 15.5 | 2.15.1-2.16.0 | 2.15.1-2.16.0 | Not Supported | 2.15.1-2.16.0 |
| 15.4 | 2.14.0-2.16.0 | 2.14.0-2.16.0 | Not Supported | 2.15.1-2.16.0 | |
| 15.0-15.3 | 2.11.0-2.16.0 | 2.11.0-2.16.0 | Not Supported | Not Supported | |
| OpenSUSE 42 | 42.2-42.3 | 2.11.0-2.11.3 | 2.9.0-2.11.3 | Not Supported | Not Supported |
| Amazon Linux 2023 | 2023 | 2.15.0-2.16.0 | 2.15.0-2.16.0 | 2.15.0 | 2.15.0-2.16.0 |
| Amazon Linux 2 | 2.0 | 2.10.1-2.16.0 | 2.10.1-2.16.0 | 2.10.1-2.13.3 | 2.15.1-2.16.0 |
| Ubuntu 22 | 22.10 | 2.14.1-2.16.0 | 2.14.1-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 |
| 22.04.04 | 2.16.0 | 2.16.0 | Not Supported | 2.16.0 | |
| 22.04.3 | 2.15.2-2.16.0 | 2.15.2-2.16.0 | 2.15.2 | 2.15.2-2.16.0 | |
| 22.04 | 2.11.3-2.16.0 | 2.11.3-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 | |
| Ubuntu 21 | 21.10 | 2.11.3-2.16.0 | 2.11.3-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 |
| 21.04 | 2.11.3-2.16.0 | 2.11.3-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 | |
| Ubuntu 20 | 20.04 LTS | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | 2.14.1-2.16.0 |
| Ubuntu 19 | 19.04, 19.10 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported |
| Ubuntu 18 | 18.04 LTS, 18.10 | 2.4.0-2.16.0 | 2.9.0-2.16.0 | 2.9.0-2.13.3 | Not Supported |
| Ubuntu 16 | 16.04 LTS | 2.4.0-2.11.3 | 2.9.0-2.11.3 | 2.9.0-2.11.3 | Not Supported |
| Debian 12 | 12.5 | 2.16.0 | 2.16.0 | Not Supported | 2.16.0 |
| 12.1-12.2 | 2.15.2-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.15.2-2.16.0 | |
| 12.0 | 2.15.1-2.16.0 | 2.15.1-2.16.0 | Not Supported | 2.15.1-2.16.0 | |
| Debian 11 | 11.9 | 2.16.0 | 2.16.0 | Not Supported | 2.16.0 |
| 11.8 | 2.15.2-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.15.2-2.16.0 | |
| 11.7 | 2.15.1-2.16.0 | 2.15.1-2.16.0 | Not Supported | 2.15.1-2.16.0 | |
| 11.4-11.6 | 2.14.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.14.1-2.16.0 | |
| 11.1-11.3 | 2.14.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.14.1-2.16.0 | |
| Debian 10 | 10.13 | 2.11.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.14.1-2.16.0 |
| 10.10-10.11 | 2.11.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | 2.14.1-2.16.0 | |
| 10.0-10.09 | 2.11.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | Not Supported | |
| Debian 9 | 9.0-9.13 | 2.11.0-2.16.0 | 2.15.2-2.16.0 | Not Supported | Not Supported |
| Rocky Linux | 9.3 | -2.16.0 | Not Supported | Not Supported | 2.16.0 |
| 9.2 | 2.15.2 | Not Supported | Not Supported | 2.15.2-2.16.0 | |
| 8.8 | 2.15.2 | Not Supported | Not Supported | 2.15.2-2.16.0 | |
Linux Supported Operating Systems and Sensors for AWS GovCloud (US)
The following is a list of Carbon Black Cloud Linux sensors. This list is specific to Carbon Black Cloud on AWS GovCloud (US).
Please see the Carbon Black Cloud Sensor Support Policy and the Linux Sensor Support Life Cycle Status page for information regarding Standard or Extended support for specific versions of the Linux Sensor.
All Linux sensors run on an x64 architecture.
Linux sensor does not support GovCloud on graviton processor based instances.
Note: Kernel version 4.4+ is required for RHEL8+.
Endpoint Standard Distributions and Kernel Versions
|
|
|
Audit and Remediation & Workloads Supported Distributions
|
|
|
Enterprise EDR Supported Distributions and Kernel Versions
|
|
|
Linux Sensor Support for osquery in Audit and Remediation
The following table shows which Carbon Black Cloud sensor versions support which versions of osquery for Audit and Remediation - Live Query.
| Linux Sensor Version | osquery Version |
|---|---|
| 2.16.0 | 5.9.1 |
| 2.15.x | 5.8.2 |
| 2.14.0 | 5.5.1 |
| 2.13.x | 5.2.2 |
| 2.12.x | 5.0.1 |
| 2.11.x | 4.8.0 |
| 2.10.x | 4.5.0 |
| 2.9.0-2.9.1 | 4.4.0 |
| 2.8.0-2.8.3 | 4.1.2 |
| 2.7.0-2.7.1 | 4.1.2 |
| 2.6.0 | 3.3.2 |
| 2.5.0 | 3.3.2 |
| 2.4.0 | 3.3.2 |
| 2.2.0 | None |
| 2.1.0 | None |
Linux Sensor Support Life Cycle Status
Use the following tables to determine the product life cycle stage of your VMware Carbon Black Cloud Linux Sensor.
The Carbon Black Cloud product release life cycle policy is located at Carbon Black Cloud Support Policy.
| Release | Enter Standard | Enter Extended | Enter End of Support |
|---|---|---|---|
| 2.16.0 | June 2024 | ||
| 2.15.x | January 2024 | December 2024 | June 2025 |
| Release | Enter Standard | Enter Extended | Enter End of Support |
|---|---|---|---|
| 2.14.x | December 2022 | February 2024 | August 2024 |
| Release | Enter Standard | Enter Extended | Enter End of Support |
|---|---|---|---|
| 2.13.x | August 2022 | June 2023 | January 2024 |
| 2.12.x | October 2021 | January 2022 | October 2022 |
| 2.11.3 | September 2021 | January 2022 | September 2022 |
| 2.11.2 | June 2021 | September 2021 | June 2022 |
| 2.11.1 | May 2021 | June 2021 | May 2022 |
| 2.11.0 | March 2021 | May 2021 | March 2022 |
| 2.10.3 | March 2021 | March 2021 | March 2022 |
| 2.10.2 | February 2021 | March 2021 | February 2022 |
| 2.10.1 | December 2020 | February 2021 | December 2021 |
| 2.9.3 | January 2021 | February 2021 | January 2022 |
| 2.9.2 | December 2020 | December 2020 | December 2021 |
| 2.9.1 | October 2020 | December 2020 | October 2021 |
| 2.9.0 | October 2020 | December 2020 | October 2021 |
| 2.8.3 | September 2020 | October 2020 | September 2021 |
| 2.8.2 | August 2020 | September 2020 | August 2021 |
| 2.8.1 | August 2020 | August 2020 | August 2021 |
| 2.8.0 | June 2020 | August 2020 | June 2021 |
| 2.7.1 | April 2020 | June 2020 | April 2021 |
| 2.7.0 | April 2020 | April 2020 | April 2021 |
| 2.6.0 | February 2020 | April 2020 | April 2021 |
| 2.5.0 | October 2019 | February 2020 | February 2021 |
| 2.4.0 | June 2019 | October 2019 | October 2020 |
| 2.2.0 | April 2019 | June 2019 | February 2020 |
| 2.1.0 | November 2018 | April 2019 | February 2020 |
