Hosted EDR:After Successfull Authentication Yara Manager Reports Unauthorized or Denied Access

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Using the correct token, the Yara rules disappear.
• /var/log/cb/integration/cb-yara-manager/cb-yara-manager.log contains HTTP 401 Unauthorized.
• Two-factor authentication may be in use, specifically DUO.
• Switching between the EDR browser tab and the Yara Manager tab breaks access.

Environment

• Hosted EDR: Version 7.x
• Yara Connector: Version 2.1.2
• Yara Manager: Version 2.1.3

Cause

Unknown at this time.

Resolution

• Fixed in EDR Server version 7.5.0

Additional Information

Workaround:

1. Clear cache.
2. Log into EDR UI in a browser window.
3. In a separate browser incognito window (not tab), log into the Yara Manager.