Starting with Carbon Black EDR version 6.5.0, Windows sensors version 6.2.4 and higher, and macOS sensor versions 6.2.7 and higher, support isolation exclusions. You can add one or more IPv4 addresses or domain URLs that isolated sensors can access in isolation mode in addition to the Carbon Black EDR server.

Prerequisites

This setting is applied on a per-sensor-group basis. It is disabled by default; to enable it, you must edit the cb.conf file. See the Carbon Black EDR Server Configuration Guide for instructions.

Procedure

  1. On the navigation bar, click Sensors.
  2. Click the gear icon next to the sensor group for which you want to add isolation exclusions.
  3. Click Isolation Exclusions and then click Add Exclusion.
  4. Enter a description that identifies the exclusion (50 character maximum), and the IPv4 address or domain URL that specifies the exclusion (253 character maximum).
    The isolation exclusion panel
  5. Select Enable this exclusion and click OK.
  6. Click Save Group.
    After you have created an exclusion, you can edit it by clicking the pencil icon, or you can remove the exclusion by clicking the trash can icon.
    Note: Duplicate exclusions are not allowed. If you enter the same IP address or URL for more than one exclusion, the last entry that was submitted is retained, but the duplicated entry is removed.