Carbon Black Cloud: Servers crashing with Palo Alto Traps installed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Servers crashing
• Bypass mode alleviates crash
• Removing Palo Alto Traps alleviates crash
• Re-enabling sensor with no Traps installed alleviates crash

Environment

• Carbon Black Cloud sensor: All Versions
• Palo Alto Traps

Cause

Palo Alto Traps requires exclusions in place in order to prevent interop issues

Resolution

Implement Permission Exclusion rules based upon Palo Alto's article found here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClPGCA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail