EDR: Yara Manager 401 Unauthorized Message
search cancel

EDR: Yara Manager 401 Unauthorized Message

book

Article ID: 287374

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • 401 is encountered when browsing to https://<server ip/hostname>/connector/yara
    • ss
  • Error found in /var/log/cb/integrations/cb-yara-manager/cb-yara-manager.log :
Traceback (most recent call last):
  File "app/routes.py", line 42, in wrapped_f
IOError: [Errno 2] No such file or directory: '/etc/cb/integrations/cb-yara-manager/auth.conf'
127.0.0.1 - - [09/Jun/2020 11:42:27] "GET /connector/yara/ HTTP/1.0" 401 -


 

Environment

  • EDR Server: Version 7.1.1
  • Yara-Connector : Version 1.x and 2.x
  • Yara-Manager: Version 1.x and 2.1.1

Cause

The session cookie is not being properly decoded.  This started happening in the 7.x versions of EDR server.

Resolution

  • Upgrade and setup the 2.1.2 Cb-Yara-Manager: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Setup-2-1-2-CB-Yara-Manager/ta-p/92383
  • When connecting, include the configured api token: https://<cbresponse>/connector/yara?token=