Carbon Black Cloud Console: The "Use Live Response" role is a required permission to see the "Live Response" role within policies or endpoints page
search cancel

Carbon Black Cloud Console: The "Use Live Response" role is a required permission to see the "Live Response" role within policies or endpoints page

book

Article ID: 287846

calendar_today

Updated On:

Products

Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops) Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Enable View Live Response Role 
    • Cannot view Live Response in Policies or Endpoints page
  • Enable Use Live Response Role
    • Can utilize all Live Response functions

Environment

  • Carbon Black Cloud Console: All Versions
    • Audit & Remediation
    • Endpoint Standard
    • Enterprise EDR
  • Carbon Black Cloud Sensor: All Versions
  • Microsoft Windows: All Supported Version

Cause

The View Live Response role relies on Use Live Response role to function. View Live Response will have the same permissions as Use Live Response role

Resolution

VMware Caron Black has identified that the current entries for "Use Live Response" and "View Live Response" are redundant. These each say "Requires the xxx permission" that references the other sub-role. This will be resolved in new roles in an upcoming backend release.

Additional Information

  • The User Guide currently states the below permissions for Live Response.
Live ResponseDescription
Use Live ResponseUse all Live Response capabilities. Initiate sessions and perform actions on enabled endpoints. Requires the "View Live Response" permission.
View Live ResponseAccess and view content on the Live Response page. Requires the "Use Live Response" permission.
 
  • View Live Response is needed to access and view the content of Live Response page