Carbon Black Cloud: How to Troubleshoot Connector or API Issues

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to troubleshoot connector or API issues

Environment

• Carbon Black Cloud Console:  All supported Versions

Resolution

Review configurations in the Carbon Black Cloud console to confirm the selections/information entered are correct:

1. Connector type
2. Connector ID
3. API Key
4. Notifications have been forwarded to the SIEM
5. Notifications have been assigned to the correct policy
6. Notifications have been subscribed to the connector

Also check for debug logs as noted in the Developer page:

https://developer.carbonblack.com/reference/cb-defense/connectors/#debug-logs
 

Additional Information

Common causes for API/Connector Issues

1. <Response [401]> Error
2. Authorized IP Field
3. REST API Not handling Multi-Byte text properly
4. Connector not connecting - URL
5. Error: Output_Format not Specified
6. Not using connector type SIEM