EDR Forwarder: Request Failed with Status Code 400 When Attempting to Configure
search cancel

EDR Forwarder: Request Failed with Status Code 400 When Attempting to Configure

book

Article ID: 287406

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • When making changes in the EDR UI Event Forwarder tab, this alert is received,  An example can be seen below:
    • https://bit9--c.na65.content.force.com/servlet/servlet.FileDownload?file=00P0h00001iQ1ke

Environment

  • EDR Server: 7.5.0 +
  • EDR Forwarder: 3.7.x +

Cause

  • Permissions on the /etc/cb/integrations/

Resolution

  • In many cases the directory permissions are incorrect and need to update the owner to 'cb' instead of 'root', since the UI is attempting to update the file as the 'cb' user:
chown cb:cb /etc/cb/integrations/event-forwarder