EDR Forwarder: Request Failed with Status Code 400 When Attempting to Configure
book
Article ID: 287406
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
When making changes in the EDR UI Event Forwarder tab, this alert is received, An example can be seen below:
Environment
EDR Server: 7.5.0 +
EDR Forwarder: 3.7.x +
Cause
Permissions on the /etc/cb/integrations/
Resolution
In many cases the directory permissions are incorrect and need to update the owner to 'cb' instead of 'root', since the UI is attempting to update the file as the 'cb' user: