Carbon Black import authorization failure

Products

• Information Centric Analytics

Issue/Introduction

The following error is returned and captured in the JsonImporter log when running the Information Centric Analytics (ICA) JsonImporter against Carbon Black App Control's v3 API:

Http Status Code Unauthorized

The account and password or API key configured for use by the importer is valid and successfully connects to the Carbon Black App Control v1 API using an API utility like Postman.

Cause

The JsonImporter is configured to use credentials that have been granted permissions to access the v1 API but not the v3 API, and the JsonImporter is hardcoded to only query Carbon Black's v3 API. When configuring the importer's settings in the CarbonBlackDW database, the user may also have entered an API URL that points to the v1 API. For example:

https://<hostname>/api/bit9platform/v1

The API URL is stored in the table dbo.ApplicationSettings in the ApiUrl column.

Resolution

Obtain assistance with configuring credential permissions to access the v3 API from your Carbon Black App Control administrator and ensure the API URL provided in the CarbonBlackDW.dbo.ApplicationSettings table points to the v3 API.