Carbon Black Cloud: USB device approvals/changes are not being recognized by a sensor.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

1. Approving a USB device in the console's policy page, waiting 20 minutes for the change to download to the sensor, the USB device is still blocked.
2. Verified that the USB device is not being blocked by another mechanism such as GPO policy.

3. a) check the audit log for when the serial number of the USB device was approved
   
   b) check the sensor status with the command ">  C:\program files\confer\repcli status" It will show the last time the sensor downloaded policy content:

   Last Manifest Content Update Time[10/06/2023 13:30:17]

   If this is before the time the SN was approved, then new content containing the approval has not been downloaded.
   
   c) Also check the repcli status for any ManifestDownloadFailure alarms. If there are no such alarms, then the sensor is able to reach the backend and download content, if content was available.

Environment

• Carbon Black Cloud Sensor: All versions
• Carbon Black Cloud Server: All versions (as of October 17, 2023)
• Carbon Black Cloud Sensor platforms:  All versions

Cause

Issue looks to be backend-related and is currently under investigation 

Resolution

Back end issue resolved October 19th, 2023. There's also a new mechanism in place to monitor for this kind of problem.