EDR: Yara Manager 401 Unauthorized Message

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• 401 is encountered when browsing to https://<server ip/hostname>/connector/yara
  • 
• Error found in /var/log/cb/integrations/cb-yara-manager/cb-yara-manager.log :

Traceback (most recent call last):
  File "app/routes.py", line 42, in wrapped_f
IOError: [Errno 2] No such file or directory: '/etc/cb/integrations/cb-yara-manager/auth.conf'
127.0.0.1 - - [09/Jun/2020 11:42:27] "GET /connector/yara/ HTTP/1.0" 401 -

 

Environment

• EDR Server: Version 7.1.1
• Yara-Connector : Version 1.x and 2.x
• Yara-Manager: Version 1.x and 2.1.1

Cause

The session cookie is not being properly decoded.  This started happening in the 7.x versions of EDR server.

Resolution

• Upgrade and setup the 2.1.2 Cb-Yara-Manager: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Setup-2-1-2-CB-Yara-Manager/ta-p/92383
• When connecting, include the configured api token: https://<cbresponse>/connector/yara?token=