To install the Carbon Black Cloud launcher and sensor on a Windows VM, run the recovery plan, start the VM, and then install the sensor.

When you run a recovery plan for ransomware recovery and configure the plan to pause, to manually install the sensor on a VM, you have two methods to install the sensor:
  • Log into the recovery SDDC vCenter and Enable Carbon Black on Virtual Machines (steps 1 through 7 in that task). Use this option if you do not have access to the Carbon Black Cloud service tile, or if you are a partner using the CPN (Cloud Provider Network) console.
  • Use the Carbon Black Cloud security console, which requires setting up a configuration file before you install and having at least one Carbon Black Cloud role associated with your user.

Carbon Black Cloud Console Sensor Installation Prerequisite

If you are installing the sensor from the Carbon Black Cloud console, before you perform this task you need to create a configuration file that you will upload to Carbon Black Cloud when you install the Windows sensor.
Note: If you do not have access to the Carbon Black Cloud console, then you do not need a configuration file.
Create the configuration file using either the INI, TXT, CONF, or CFG file extension, and then add the following to the contents of the file, exactly as is: 
[customer]
CurlCrlCheck=false
GroupName=VMware Live Cyber Recovery
PolicyName=VMware Live Cyber Recovery
DelaySigDownload=0

Have this file available before you start the recovery plan plan.

Procedure

  1. Start the plan by clicking the Ransomware Recovery button.
  2. In the VMs list of the plan, click the Windows VM.
  3. In the Ransomware recovery page, click Start Ransomware Recovery.
  4. On the ransomware recovery iteration page, click the Start VM in Recovery SDDC button.
  5. In the Validate VM in recovery SDDC dialog box, select a snapshot of the VM you want to analyze. Then, click Start VM In Recovery SDDC.
  6. As the VM starts, the system pauses the VM recovery so you can install the Windows sensor. Under Start VM, you see the following:
    Message asking you to install the Windows sensor.
  7. If you are installing the sensor manually using the recovery SDDC vCenter, then follow the steps to enable Carbon Black on VMs. You do not need to follow the remaining steps in this task.
  8. If you are using the Carbon Black Cloud console to install the sensor, go to your VMware Cloud organization home page and click the Carbon Black Cloud tile to launch the console.
    Note: Opening the Carbon Black Cloud console requires at least one Carbon Black Cloud user role.
  9. In the Carbon Black Cloud console, browse to Inventory > VM Workloads.
  10. Select the Not Enabled tab.
  11. Next, select the Eligible check box next to the VM, and then from the Take Action menu, select Install Sensors.
    Menu item to open VM in Carbon Black Cloud security console.
  12. In the Install Sensor dialog box, click the Upload File dialog box.
  13. Select the file you created before starting this task. You see the file uploaded.
    Install sensor dialog box, with uploaded config file.
  14. click the Install button. After the sensor installs, it appears on the Enabled tab.
  15. When the sensor successfully installs, restart the VM.

What to do next

Now that you have installed the sensor, return to the VMware Live Cyber Recovery UI so integrated security and vulnerability analysis can begin on the VM.