Carbon Black Cloud Console: The "Use Live Response" role is a required permission to see the "Live Response" role within policies or endpoints page
book
Article ID: 287846
calendar_today
Updated On:
Products
Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Enable View Live Response Role
Cannot view Live Response in Policies or Endpoints page
Enable Use Live Response Role
Can utilize all Live Response functions
Environment
Carbon Black Cloud Console: All Versions
Audit & Remediation
Endpoint Standard
Enterprise EDR
Carbon Black Cloud Sensor: All Versions
Microsoft Windows: All Supported Version
Cause
The View Live Response role relies on Use Live Response role to function. View Live Response will have the same permissions as Use Live Response role
Resolution
VMware Caron Black has identified that the current entries for "Use Live Response" and "View Live Response" are redundant. These each say "Requires the xxx permission" that references the other sub-role. This will be resolved in new roles in an upcoming backend release.
Additional Information
The User Guide currently states the below permissions for Live Response.
Live Response
Description
Use Live Response
Use all Live Response capabilities. Initiate sessions and perform actions on enabled endpoints. Requires the "View Live Response" permission.
View Live Response
Access and view content on the Live Response page. Requires the "Use Live Response" permission.
View Live Response is needed to access and view the content of Live Response page