Carbon Black Cloud Console: The "Use Live Response" role is a required permission to see the "Live Response" role within policies or endpoints page

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Enable View Live Response Role 
  • Cannot view Live Response in Policies or Endpoints page
• Enable Use Live Response Role
  • Can utilize all Live Response functions

Environment

• Carbon Black Cloud Console: All Versions
  • Audit & Remediation
  • Endpoint Standard
  • Enterprise EDR
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Version

Cause

The View Live Response role relies on Use Live Response role to function. View Live Response will have the same permissions as Use Live Response role

Resolution

VMware Caron Black has identified that the current entries for "Use Live Response" and "View Live Response" are redundant. These each say "Requires the xxx permission" that references the other sub-role. This will be resolved in new roles in an upcoming backend release.

Additional Information

• The User Guide currently states the below permissions for Live Response.

Live Response	Description
Use Live Response	Use all Live Response capabilities. Initiate sessions and perform actions on enabled endpoints. Requires the "View Live Response" permission.
View Live Response	Access and view content on the Live Response page. Requires the "Use Live Response" permission.

 

• View Live Response is needed to access and view the content of Live Response page