EDR: How to Setup 2.1.2 CB-Yara-Manager

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Setup CB Yara Manager 2.1.2+.

Environment

• EDR: All Supported Versions
• CB-Yara-Manager: Version 2.1.2+

Resolution

• Ensure CB-Yara-Connector installed and configured, see here: https://github.com/carbonblack/cb-yara-connector/
• Install 2.1.2 cb-yara-manager using instructions here: Install Yara Manager
• Add in /etc/cb/integrations/cb-yara-manager/auth.conf with the following contents, replacing adequately_long_and_complex_password_or_token with a token or suitable passphrase of choice:

[auth]
api_token=adequately_long_and_complex_password_or_token

• Restart cb-yara-connector and cb-yara-manager services
  • CentOS6 : 
    • service cb-yara-connector restart
    • service cb-yara-manager restart
  • CentOS7 : 
    • systemctl restart cb-yara-connector
    • systemctl restart cb-yara-manager
• Browse to the Cb-Yara-Manager URL using the following : 
  • https://<cbresponse>/connector/yara?token=adequately_long_and_complex_password_or_token

 

• An 'Unauthorized' message will be displayed if improperly setup or if the access token/password is incorrect :