EDR: How to Setup 2.1.2 CB-Yara-Manager
search cancel

EDR: How to Setup 2.1.2 CB-Yara-Manager

book

Article ID: 286259

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Setup CB Yara Manager 2.1.2+.

Environment

  • EDR: All Supported Versions
  • CB-Yara-Manager: Version 2.1.2+

Resolution

  • Ensure CB-Yara-Connector installed and configured, see here: https://github.com/carbonblack/cb-yara-connector/
  • Install 2.1.2 cb-yara-manager using instructions here: Install Yara Manager
  • Add in /etc/cb/integrations/cb-yara-manager/auth.conf with the following contents, replacing adequately_long_and_complex_password_or_token with a token or suitable passphrase of choice:
[auth]
api_token=adequately_long_and_complex_password_or_token
  • Restart cb-yara-connector and cb-yara-manager services
    • CentOS6 : 
      • service cb-yara-connector restart
      • service cb-yara-manager restart
    • CentOS7 : 
      • systemctl restart cb-yara-connector
      • systemctl restart cb-yara-manager
  • Browse to the Cb-Yara-Manager URL using the following : 
    • https://<cbresponse>/connector/yara?token=adequately_long_and_complex_password_or_token
 
  • An 'Unauthorized' message will be displayed if improperly setup or if the access token/password is incorrect : 
User-added image