Carbon Black provides diagnostic scripts for each supported platform. These make it easy to collect the information most commonly required for troubleshooting.
For sensor versions 6.2.1 and below
Step 1: Obtain the Diagnostic Tool
Step 2: Gather Diagnostics
- Once you have extracted the package, execute the binary with administrative privileges
- When prompted, press 0 to being the process.
The following could take up to 10+ minutes to finish.
Once complete, a new archive will be created in the local folder named for the time of generation:
For sensor versions 6.2.2 and above
Note: .NET 4.5 or higher needs to be installed for this tool to work.
Step 1: Open Command Prompt as Administrator
Change directory to C:\Windows\CarbonBlack
Step 2: Run the diagnostic tool
sensordiag.exe --type CDE
Collect the C:\Windows\CarbonBlack\diags\<filename>.zip
(Remote option) Collect diagnostics via Live Response session
Open a Live Response session with the endpoint and perform the following:
You'll want to
put the diagnostic package in the desired remote directory
execfg CbDiag.exe --tar
get the resulting diagnostic package
Send the file to your Red Canary Incident Handler from the portal via Administration > Share a File.