CB Response Unified View: Heartbeats failing with 401

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Cluster labeled 'Unstable'
• Recent errors table shows 401 Codes with Invalid Credentials Error
• Heartbeat count is low

Environment

• CB Response Server: 6.x and Higher
• CB Response Unified View: 6.1.3

Cause

The original token used for authentication was changed

Resolution

Update the user token in Unified View for the cluster
 

Additional Information

• If using Individual Tokens, the user must disable their connection to the cluster for a different user's token to be used. Unified View will not automatically switch to another token due to CB-25487