Hosted EDR:After Successfull Authentication Yara Manager Reports Unauthorized or Denied Access
book
Article ID: 285262
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Using the correct token, the Yara rules disappear.
- /var/log/cb/integration/cb-yara-manager/cb-yara-manager.log contains HTTP 401 Unauthorized.
- Two-factor authentication may be in use, specifically DUO.
- Switching between the EDR browser tab and the Yara Manager tab breaks access.
Environment
- Hosted EDR: Version 7.x
- Yara Connector: Version 2.1.2
- Yara Manager: Version 2.1.3
Cause
Unknown at this time.
Resolution
- Fixed in EDR Server version 7.5.0
Additional Information
Workaround:
- Clear cache.
- Log into EDR UI in a browser window.
- In a separate browser incognito window (not tab), log into the Yara Manager.
Feedback
thumb_up
Yes
thumb_down
No