Live Query Error Failed Websocket Connection to Fetch Results

Products

• Carbon Black EDR

Issue/Introduction

A pop up box appears on the Live Query console reporting "Failed websocket connection to fetch Live Query results".

Environment

• Carbon Black EDR Server: 7.6.0 and higher

Cause

An EDR port needed to perform a Live Query has closed or is blocked.

Resolution

1. Restart the 'cb-enterprise' services
2. Reattempt the Live Query when the EDR console is back up.

Additional Information

Check the firewall and selinux settings with /usr/share/cb/cbcheck command.