This article describes how to install the Carbon Black EDR Linux sensor on an endpoint.

Prerequisites

Important: Before you install the 7.1.+ Linux sensor, see Downgrading Carbon Black EDR Linux Sensors.
Note: To install sensors on Linux systems, you must be a root user or have “sudoer” permissions and run the installer with “sudo”.

You must have the following requirements before installing the sensor:

  • Carbon Black EDR server version 5.0 or higher
  • OpenSSL version 1.0.1 or higher

To have access to the Download Sensor Installer controls for a sensor group, you must be one of the following:

  • A user that is a member of a team that has either the Viewer or Analyst role for the sensor group.
  • For Carbon Black EDR installations, a Global Administrator.
  • For Carbon Black Hosted EDR installations, an Administrator.

Procedure

  1. On the navigation bar, click Sensors.
  2. In the Groups panel, select the sensor group for which you want to install the sensor package.
  3. From the Download Sensor Installer drop-down list, select Linux Standalone RPM. The sensor package file is downloaded to your system.
  4. In the operating system, do the following:
    1. Copy the <install package name>.tar.gz sensor installation package to the Linux endpoint.
    2. Untar the <install package name>.tar.gz file to a temporary folder.
      For example, at a command prompt and from the directory where the file is installed, run this command: 
      tar -zxvf <install file name>.tar.gz
    3. From the extracted .tar.gz file, run the .sh file and follow the installation prompts. This installs the Linux sensor using the configuration provided in the sensorsettings.ini file.

Results

After this process is complete, the Linux sensor is installed and running. The Sensors page in the Carbon Black EDR console shows the sensor as registered and checking into the Carbon Black EDR server.