Cb Threat Intel Enabled But Not Connected

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

EDR Console shows error: "Cb Threat Intel enabled but not connected"

Environment

EDR Console: 5.x and Higher (formerly CB Response)

Cause

Server could be temporarily disconnected from the Cb Alliance server due to networking, proxy or Alliance server traffic congestion.

Resolution

Verify that EDR Alliance Systems are operational: https://status.broadcom.com
Ensure communication to the threat intel site has been allowed as per the Server Cluster Management Guide, in the Ports and Protocols section.
If Alliance is reporting as All Systems Operational, then restart EDR services

If still receiving 400/500/600s errors following a service restart

Collect the Redis errors:

Non-password protected Redis:

redis-cli -n 1 hgetall AllianceCommStatus > /tmp/comms_troubleshooting-`hostname`_"`date`".txt

Password protected Redis:

pass=$(grep 'RedisPassword' /etc/cb/cb.conf | awk -F '=' '{print$2}'); redis-cli -a $pass --no-auth-warning --tls --cert /etc/cb/certs/cb-redis.crt --key /etc/cb/certs/cb-redis.key --cacert /etc/cb/certs/cb-redis-ca.crt -n 1 hgetall AllianceCommStatus > /tmp/comms_troubleshooting-`hostname`_"`date`".txt

Upload PostgreSQL comm errors to our alliance server via the cbpost command:

psql -d cb -p 5002 -c "SELECT * FROM allianceclient_comm_history ORDER BY timestamp DESC;" > /tmp/alliancecommhistory.out

Run this to make an Alliance connection attempt, if there is an error please post the output to the case and check the Related Issues:

curl --cert /etc/cb/certs/carbonblack-alliance-client.crt --key /etc/cb/certs/carbonblack-alliance-client.key https://api.alliance.carbonblack.com:443/api/v1/feeds/ > /tmp/alliance_comm_test.out

Upload Cbdiags to Alliance: Generate Server Diagnostic Logs for On-Prem (i.e., CBDiags)
Update the case when the uploads have been completed

Additional Information

Warning: Logs must be collected within 30 minutes of a communication error appearing for relevant information to be collected
This curl command verifies that the server doesn't get a certificate issue when connecting to an Alliance Feed

Other items such as sensordiag/settings can trigger the red banner even if disabled. These are not related to threat intel feeds, instead it's suggested to run this command specifically to confirm feeds are not the issue. If the response is empty, all feeds are healthy.

Non-password protected Redis

redis-cli -n 1 hgetall AllianceCommStatus | awk '{getline line2;print $0, line2}' | grep 'feed' | grep -v '\[200,'

Password protected Redis

pass=$(grep 'RedisPassword' /etc/cb/cb.conf | awk -F '=' '{print$2}'); redis-cli -a $pass --no-auth-warning --tls --cert /etc/cb/certs/cb-redis.crt --key /etc/cb/certs/cb-redis.key --cacert /etc/cb/certs/cb-redis-ca.crt -n 1 hgetall AllianceCommStatus | awk '{getline line2;print $0, line2}' | grep 'feed' | grep -v '\[200,'