CB Response: Response Sensor Getting HTTP 400 When Uploading Data

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors unable to upload data to CB Response Server
• NGINX access.log showing the following: "POST /data/eventlog/submit2/<sensorid> HTTP/1.1" 400

Environment

• CB Response Server: 6.5.2 and Higher
• CB Response Sensor: 6.2.3

Cause

Latency in the network, due to bandwidth issues.

Resolution

Throttle sensors due to lack of bandwidth to compensate for latency:

• https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-Setup-Site-Throttling/ta-p/72147