Configuring VMware Carbon Black EDR sensors to use a proxy (Windows sensors)

Issue

User is using a proxy and wants to send their sensor traffic through the proxy.

Environment

Windows

VMware Carbon Black EDR (Response)

Resolution

You can add the proxy information to the sensorsettings.ini file to be set up at installation, or can add it to the registry if the sensor is already installed. Choose the option that suits your use case. 

• Proxy Options
  • "server:port" | Where server is the proxy server and port is the port of the proxy server.
  • "@wpad" | 6.2.3 and above only. Instructs the sensor to auto-detect proxy with WPAD protocol.
  • "@pacurl:URL" | 6.2.3 and above only. Where URL is the URL of the PAC file to download and use the proxy configured in the file.
• To add the proxy setting follow one of the two options:
  • Open the zip file of the installer contents and modify the sensorsettings.ini file by adding the Proxy config anywhere in the file. For example, adding autodetect proxy (@wpad):

    Proxy=@wpad

  • If the sensor is already installed, the following registry edit command can be used, with the example showing autodetect proxy (@wpad):

    reg add HKLM\SOFTWARE\CarbonBlack\config /v Proxy /t REG_SZ /d @wpad

Additional information

• 6.2.3 and above sensors have enhanced behavior for proxy communication.
• The sensor gets the beginning packet and sends it to the user service to check if it's going through a proxy.
• If communication fails over proxy, the sensor will try using direct communication.