Hosted EDR:After Successfull Authentication Yara Manager Reports Unauthorized or Denied Access
search cancel

Hosted EDR:After Successfull Authentication Yara Manager Reports Unauthorized or Denied Access

book

Article ID: 285262

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Using the correct token, the Yara rules disappear.
  • /var/log/cb/integration/cb-yara-manager/cb-yara-manager.log contains HTTP 401 Unauthorized.
  • Two-factor authentication may be in use, specifically DUO.
  • Switching between the EDR browser tab and the Yara Manager tab breaks access.

Environment

  • Hosted EDR: Version 7.x
  • Yara Connector: Version 2.1.2
  • Yara Manager: Version 2.1.3

Cause

Unknown at this time.

Resolution

  • Fixed in EDR Server version 7.5.0

Additional Information

Workaround:
  1. Clear cache.
  2. Log into EDR UI in a browser window.
  3. In a separate browser incognito window (not tab), log into the Yara Manager.