Carbon Black EDR Event Forwarder 3.7.6 Released

Posted on July 20, 2022

Event Forwarder 3.7.6 is now generally available for all on-prem EDR customers.

Event Forwarder 3.7.6 is the only version that should be run with Server 7.7.0 at the time of this writing and replaces 3.8.0 and 3.8.1 as the latest stable release.

This is a maintenance release that delivers the following bug fixes:

  • Corrects an issue in which Event Forwarder could not authenticate with EDR Server versions 7.7.0 and greater, causing Event Forwarder to fail to start.

Download

On-prem EDR customers can download Event Forwarder 3.7.6 from GitHub.

Installation Instructions

Important: Removal of version 3.8.0 or 3.8.1

For customers running Event Forwarder versions 3.8.0 or 3.8.1, you will first need to remove that version of Event Forwarder before installing Event Forwarder 3.7.6.

  • Stop the Event Forwarder service: 
    sudo service cb-event-forwarder stop
  • Remove the current Event Forwarder package: 
    sudo yum remove cb-event-forwarder

For customers running Event Forwarder versions 3.7.5 or older, the following installation instructions will install Event Forwarder 3.7.6 without first removing the previous version.

Installation

To install and configure the cb-event-forwarder, perform these steps as “root” on your target Linux system.

NOTE: If you plan to use the EDR console to configure and control cb-event-forwarder, then you MUST install it on the same system on which EDR is installed (in the case of a cluster installer, this means the primary node).

  • Install the CbOpenSource repository if it isn’t already present: 
    cd /etc/yum.repos.d
curl -O https://opensource.carbonblack.com/release/x86_64/CbOpenSource.repo
  • Install the RPM via YUM: 
    yum install cb-event-forwarder-3.7.6
  • If you are using EDR 7.1.0 or greater and wish to use the EDR console to configure and operate the Event Forwarder, run the following script to set the appropriate permissions needed by EDR: 
    /usr/share/cb/integrations/event-forwarder/cb-edr-fix-permissions.sh

More Information

More information on Event Forwarder can be found at: