Assign Carbon Black Cloud Sensor to Established Sensor Group During Install – Zscaler MDR Support

Issue

Is there a way to automatically assign a new device to an established Sensor group within Carbon Black Enterprise EDR (Threat Hunter)?

Environment

Carbon Black Enterprise EDR (formerly Threat Hunter)

Resolution

If you go to Endpoints -> Sensor Groups -> Edit the Sensor Group, you can set the Criteria for new sensors to be added to that group.

The sensor group can also be set via command line at install. In the below examples, we are setting the company code as "XYZ" and the group name as "Phase1":

Windows

msiexec /q /i C:\Users\UserFolderName\Desktop\installer_vista_win7_win8-32-3.3.0.953.msi /L* log.txt COMPANY_CODE=XYZ GROUP_NAME=Phase1

See https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-sensor-installation-guide/GUID-51288B44-1BA4-4CFA-916C-304E3565A779.html for more.

macOS

sudo /tmp/cbcloud_install_unattended.sh -i '/tmp/CBCloud Install.pkg' -c 'XYZ' -g 'Phase1'

See https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-sensor-installation-guide/GUID-B473D90C-B5CE-42CA-87A5-715565B68315.html for more.