Installing Carbon Black EDR Unified View

This topic describes how to perform an installation of Carbon Black EDR Unified View on a system that has no previous version installed.

Note:

This release of Carbon Black EDR Unified View supports only 6-series Carbon Black EDR servers and above. To manage 5-series Carbon Black EDR servers and earlier with Carbon Black EDR Unified View, you must use a separate Carbon Black EDR Unified View (CB-Fed) version 1.1.0, which is available from the Carbon Black yum repository. You cannot manage Carbon Black EDR 5- and 6-series servers from a single Carbon Black EDR Unified View server.

This release of Carbon Black EDR Unified View does not support in-place upgrades from the earliest Carbon Black EDR Unified View versions, named CB-Fed v.1.x.x, but does allow you to upgrade from Carbon Black EDR Unified View 6.1.3. See Upgrading from an Earlier Release.

To install Carbon Black EDR Unified View on a new system:

1. Obtain the RPM installation package for Carbon Black EDR.

   If you are a Carbon Black EDR on-premises customer, you received this RPM package when you installed the Carbon Black EDR server.

   If you do not have access to this file, or if you are a Carbon Black Hosted EDR customer, contact Carbon Black Technical support to obtain the file.

2. Install the RPM package using the following command:

   sudo rpm -ivh carbon-black-release-<license version>.<customername>.x86_64.rpm

   This file adds Carbon Black EDR SSL certificates and keys to the /etc/cb/certs/ directory:

3. Remove the file CarbonBlack.repo from the /etc/yum.repos.d directory, or edit the file and set enabled=0.

4. Create the following new repo file specific to Carbon Black EDR Unified View:

   /etc/yum.repos.d/CarbonBlackUnifiedView.repo

5. Edit the CarbonBlackUnifiedView.repo file to have the following contents:

   [CbUnifiedView]
   name=CbUnifiedView
   baseurl=https://yum.distro.carbonblack.io/unifiedview/stable/$releasever/$basearch/
   gpgcheck=0
   enabled=1
   metadata_expire=60
   sslverify=1
   sslclientcert=/etc/cb/certs/carbonblack-alliance-client.crt
   sslclientkey=/etc/cb/certs/carbonblack-alliance-client.key

6. For EL6 and EL7 servers, run the following command:

   $ sudo yum install cb-unifiedview

   For EL8 servers, run the following commands:

   $ sudo yum module disable postgresql redis
   $ sudo yum install cb-unifiedview

7. Type y to confirm that you want to install the available packages comprising the Carbon Black EDR Unified View installation.

8. Initialize the Carbon Black EDR Unified View server using the following script:

   /usr/share/cb/cbinituv

   This script does the following:

   • Presents the End User License Agreement (type yes to accept).

   • Sets up the initial administrator account.

   • Completes the operating environment for Carbon Black EDR Unified View server (firewall, database, and encryption key).

9. Start services by typing y at the prompt. Or, you can start services later by using the following command:

   service cb-unifiedview start

   Carbon Black EDR Unified View server installation is now complete.

You can log into the Carbon Black EDR Unified View server (through https://localhost or https://<serveraddress> ) using credentials for the initial administrator account that you created when you ran /usr/share/cb/cbinituv in the previous procedure. See Logging in to Carbon Black EDR Unified View.