EDR Forwarder: Request Failed with Status Code 400 When Attempting to Configure

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When making changes in the EDR UI Event Forwarder tab, this alert is received,  An example can be seen below:
  • 

Environment

• EDR Server: 7.5.0 +
• EDR Forwarder: 3.7.x +

Cause

• Permissions on the /etc/cb/integrations/

Resolution

• In many cases the directory permissions are incorrect and need to update the owner to 'cb' instead of 'root', since the UI is attempting to update the file as the 'cb' user:

chown cb:cb /etc/cb/integrations/event-forwarder