Cb Defense: What do the HTTP Error Codes for the SIEM Connector mean?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

In the /var/log/cb/integrations/cb-defense-syslog/cb-defense-syslog.log, what do the HTTP errors mean?

 

Environment

• CB Defense Web Console: All Versions
• CB Defense SIEM Connector: All Supported Versions

Resolution

• HTTP 200: Successful response. This means a successful connection has been made.
• HTTP 400: Bad request. Check the messages response for more information on errors encountered parsing the incoming payload.
• HTTP 401: Unauthorized. Double check the X-Auth-Token authentication HTTP header to make sure that the Connector ID and API key are valid.
• HTTP 404: Object not found. The requested object could not be found in the backend data store or it may have expired (over 30 days old, etc.)
• HTTP 429: Rate limiting encountered. Try again in a minute.
• HTTP 500: Internal server error. Check the messages response for more information.

Additional Information

• In addition, each message returns a boolean success indicator that indicates whether the operation was successful. The response contents should be further examined or processed only if the success indicator is true.
• If there is another HTTP Error logged, or the above errors cannot be resolved, please Contact Support for Help
• For a full list of HTTP Error Codes: Hypertext Transfer Protocol (HTTP) Status Code Registry