Threat Intel it is enabled but connected

Products

• Carbon Black EDR

Issue/Introduction

• Error on the UI "Threat Intel it is enabled but connected" 
• Error code 602, 601, or 502

Environment

• Carbon Black EDR Server: Supported Versions

Cause

• Network congestion on Threat Intel side
• Other temporary issues at Threat Intel side.

Resolution

1. Add or modify the following 2 lines in /etc/cb/cb.conf file: 

   vi /etc/cb/cb.conf

2. This needs to be done on the Primary and all minion servers in case of cluster:

   #Report more than 5 errors in the last 60 minutes 
   AllianceClientFailThreshold=5 
   
   #Call alliance every 3 minutes instead of every 1 minute 
   AllianceSyncIntervalSecs=180

3. Restart Services

Additional Information

• The proposed suggestion/action is to tweak criteria when to report the errors in the UI as red (Threat Intel not working) as well as to reduce the frequency of alliance calls from every minute to every 3 minutes.
• Make sure feeds are updating regularly. Below psql query can be used for verifying the feeds update.

  psql -d cb -p 5002 -c "select id,name,update_timestamp from alliance_feeds order by update_timestamp;"