CB Response: Admin gets logged out of UI when opening any alert in Alert Triage page.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Admin gets logged out of UI when opening any alert in Alert Triage page.

Environment

• CB Response Server: 6.0.1 and Higher

Cause

• Admin gets logged out of UI when opening any alert in Alert Triage page
• Occurs on a cluster
• /var/log/cb/nginx/access.log on the master shows no activity from the browser host
• /var/log/cb/nginx/access.log on the minion shows a browser connection
• Also seeing 403 permission errors on several other pages

Resolution

The browser URL to the UI was going to a minion in the cluster rather than the master.
It was fixed by changing to the master.